-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing realm validation in two critical user retrieval paths: 1) The cache implementation (UserCacheSession) didn't check if the cached user's realm matched the request context. 2) The JPA provider (JpaUserProvider) didn't include realm ID in its database query constraints. The commit 0b73685 added realm checks in both locations, confirming these were the vulnerable points. The accompanying test (UserTest.testAccessUserFromOtherRealm) demonstrates the exploit scenario prevented by these fixes.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-model-infinispan | maven | < 7.0.1 | 7.0.1 |
| org.keycloak:keycloak-model-jpa | maven | < 7.0.1 | 7.0.1 |
JavaJavaOngoing coverage of React2Shell