CVE-2018-14637: Improper Authentication in Keycloak
Summary
CVE-2018-14637: Improper Authentication in Keycloak. Affects org.keycloak:keycloak-core versions < 4.6.0. Fixed in 4.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides single sign-on, social login, and user federation capabilities. It is widely used to secure applications and services by managing user authentication and authorization. The Keycloak Core package (org.keycloak:keycloak-core) is a fundamental component of Keycloak, responsible for handling core functionality and security features. Unfortunately, a vulnerability has been discovered in Keycloak Core that allows for improper authentication.
Vulnerability Detail
The SAML broker consumer endpoint in Keycloak prior to version 4.6.0.Final does not properly enforce expiration conditions on SAML assertions. This flaw can be exploited by an attacker to perform a replay attack. By replaying a valid SAML assertion, an attacker can gain unauthorized access to protected resources or impersonate another user. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the affected system.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.6.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading Keycloak Core to the latest version.
Conclusion
The vulnerability in Keycloak Core (org.keycloak:keycloak-core) allows for improper authentication due to the SAML broker consumer endpoint ignoring expiration conditions on SAML assertions. This can be exploited by attackers to perform replay attacks, compromising the security of the system. It is recommended to upgrade Keycloak Core to version 4.6.0.Final or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides single sign-on, social login, and user federation capabilities. It is widely used to secure applications and services by managing user authentication and authorization.
The Keycloak Core package (org.keycloak:keycloak-core) is a fundamental component of Keycloak, responsible for handling core functionality and security features.
A replay attack is a type of attack where an attacker intercepts and retransmits valid data to gain unauthorized access or impersonate another user.
This vulnerability can lead to unauthorized access to protected resources, data breaches, and impersonation of users, compromising the confidentiality, integrity, and availability of the affected system.
To mitigate this vulnerability, it is crucial to upgrade Keycloak Core to version 4.6.0.Final or later. This will ensure that the necessary fixes are applied to properly enforce expiration conditions on SAML assertions.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
