| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | < 21.1.2 | 21.1.2 |
| openshift container platform | = 4.10= 4.11= 4.12= 4.9 | |
| single sign-on | = 7.6 |
When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free