Keycloak vulnerable to LDAP Injection on UsernameForm Login

概要

参考情報

• keycloak/keycloak security advisory · WEB
• keycloak/keycloak commit 4252e39 · WEB
• keycloak/keycloak · PACKAGE
• access.redhat.com/errata/RHSA-2024:0094
• access.redhat.com/errata/RHSA-2024:0095
• access.redhat.com/errata/RHSA-2024:0096
• access.redhat.com/security/cve/CVE-2022-2232
• bugzilla.redhat.com/show_bug.cgi

org.keycloak:keycloak-ldap-federation のその他の脆弱性

• CVE-2026-9801中 4.9A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Dire…
• CVE-2025-13467中 5.5A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger de…
• CVE-2025-0604中 5.4A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to …
• CVE-2024-5967低 2.7A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL  independently without re-entering the c…