| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-ldap-federation | ≥ 26.1.0, < 26.1.3< 26.0.10 | 26.1.326.0.10 |
The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free