Security controls bypass or absence In org.keycloak:keycloak-core
Description
Moderate severity vulnerability that affects org.keycloak:keycloak-core It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 3.4.2 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.