Improper authorization control for web services In org.keycloak:keycloak-core
Description
Improper Authentication in Keycloak The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 4.6.0 | ||
 npm | 4.6.0 |
Aliases
1. 2. 3. 4. 5. 6.