CVE-2023-3597

MEDIUM5.0EPSS 0.09%

Keycloak secondary factor bypass in step-up authentication

發布日:2024/4/17修改日:2026/2/4

描述

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.0CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

參考連結(9)