CVE-2021-20262: Missing authentication for critical function in Keycloak
Summary
CVE-2021-20262: Keycloak Missing authentication for critical function. Affects org.keycloak:keycloak-core versions < 12.0.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, user authentication, and authorization. The key package affected by this vulnerability is 'org.keycloak:keycloak-core'. This package is an essential component of Keycloak, responsible for core functionality and security features. Unfortunately, a flaw in version 12.0.0 of Keycloak allows an attacker to take over an account without proper authentication during the password update process. This vulnerability poses a significant risk to the confidentiality, integrity, and availability of the system.
Vulnerability Detail
The vulnerability (CVE-2021-20262) in Keycloak 12.0.0 arises from the absence of authentication during the password update process. When a user updates their password, re-authentication should be enforced to ensure the user's identity. However, in this version, re-authentication does not occur, making it possible for an attacker with temporary physical access to the user's browser to take over the account. This vulnerability can lead to unauthorized access, data breaches, and potential system compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually enforce re-authentication before updating their password. This can be done by logging out and logging back in before changing the password. However, this workaround is not foolproof and may still leave the account vulnerable if the user's browser is compromised.
Conclusion
In conclusion, the missing authentication vulnerability in Keycloak 12.0.0 poses a significant risk to the security and integrity of user accounts. It is crucial for organizations using Keycloak to promptly update to version 12.0.4 or a later version to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides features such as single sign-on, user authentication, and authorization.
The impacted package is 'org.keycloak:keycloak-core', which is a core component of Keycloak responsible for essential functionality and security features.
The vulnerability (CVE-2021-20262) is a missing authentication flaw that allows an attacker to take over an account without proper authentication during the password update process.
This vulnerability can lead to unauthorized access, data breaches, and potential compromise of the system's confidentiality, integrity, and availability.
To fix this vulnerability, it is recommended to upgrade to version 12.0.4 or any subsequent version of the 'org.keycloak:keycloak-core' package, which includes the necessary patch to enforce re-authentication during the password update process.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
