A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Redhat |
|
No data.
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat build of Keycloak 24 | |||
| rhbk/keycloak-operator-bundle:24.0.9-1 | cpe:/a:redhat:build_keycloak:24::el9 | RHSA-2024:10175 | 2024-11-21T00:00:00Z |
| rhbk/keycloak-rhel9:24-18 | cpe:/a:redhat:build_keycloak:24::el9 | RHSA-2024:10175 | 2024-11-21T00:00:00Z |
| rhbk/keycloak-rhel9-operator:24-18 | cpe:/a:redhat:build_keycloak:24::el9 | RHSA-2024:10175 | 2024-11-21T00:00:00Z |
| Red Hat build of Keycloak 24.0.9 | |||
| org.keycloak/keycloak-core | cpe:/a:redhat:build_keycloak:24 | RHSA-2024:10176 | 2024-11-21T00:00:00Z |
| Red Hat build of Keycloak 26.0 | |||
| rhbk/keycloak-operator-bundle:26.0.6-2 | cpe:/a:redhat:build_keycloak:26.0::el9 | RHSA-2024:10177 | 2024-11-21T00:00:00Z |
| rhbk/keycloak-rhel9:26.0-5 | cpe:/a:redhat:build_keycloak:26.0::el9 | RHSA-2024:10177 | 2024-11-21T00:00:00Z |
| rhbk/keycloak-rhel9-operator:26.0-6 | cpe:/a:redhat:build_keycloak:26.0::el9 | RHSA-2024:10177 | 2024-11-21T00:00:00Z |
| Red Hat build of Keycloak 26.0.6 | |||
| org.keycloak/keycloak-core | cpe:/a:redhat:build_keycloak:26 | RHSA-2024:10178 | 2024-11-21T00:00:00Z |
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-93ww-43rr-79v3 | Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Fri, 22 Nov 2024 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism. | |
| Title | keycloak-core: mTLS passthrough | |
| First Time appeared |
Redhat
Redhat build Keycloak |
|
| Weaknesses | CWE-295 | |
| CPEs | cpe:/a:redhat:build_keycloak:24 cpe:/a:redhat:build_keycloak:24::el9 cpe:/a:redhat:build_keycloak:26 cpe:/a:redhat:build_keycloak:26.0::el9 |
|
| Vendors & Products |
Redhat
Redhat build Keycloak |
|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
No data.
Vulnrichment
No data.
NVD
No data.
Redhat
OpenCVE Enrichment
No data.