Keycloak Unauthenticated Access

CAO 7.5CVE-2019-14832 · GHSA-8prc-58j4-m55q · Công bố 15/10/2019 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2019-14832 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng org.keycloak:keycloak-model-infinispan, org.keycloak:keycloak-model-jpa, keycloak (redhat).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.54%, cao hơn 45.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 7.0.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.keycloak:keycloak-model-infinispan Maven	`< 7.0.1`	`7.0.1`
org.keycloak:keycloak-model-jpa Maven	`< 7.0.1`	`7.0.1`
keycloak redhat	`< 7.0.1`	`7.0.1`

Mô tả

A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

Mô tả của NVD

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.