A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Build of Keycloak | RedHat | org.keycloak.authentication | * |
| Red Hat build of Keycloak 26.0 | RedHat | rhbk/keycloak-operator-bundle:26.0.11-2 | * |
| Red Hat build of Keycloak 26.0 | RedHat | rhbk/keycloak-rhel9:26.0-12 | * |
| Red Hat build of Keycloak 26.0 | RedHat | rhbk/keycloak-rhel9-operator:26.0-13 | * |