CyberRota Analysis
AI-GeneratedKeycloak is vulnerable due to improper access control in its JSON Web Token (JWT) authorization grant processing, specifically when the feature is enabled and a user account is disabled. This flaw allows a remote attacker with minimal privileges to exploit the system by presenting a valid assertion token from an external identity provider, thereby gaining unauthorized access to sensitive resources. Organizations using Keycloak, particularly those leveraging JWT for authentication, should prioritize addressing this vulnerability to mitigate potential security breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.
Related CVEs
Other vulnerabilities affecting the same vendor(s)