-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs when the LDAP bind type is set to 'none', which enables anonymous binding. In this mode, the authentication function does not properly validate user credentials, allowing any password to be accepted. The LDAPStorageProvider.authenticate method is central to Keycloak's LDAP authentication flow and would logically contain the conditional logic for handling different bind types. Since the vulnerability directly relates to improper authentication (CWE-287) and authentication bypass (CWE-305) in this configuration, this function is the most likely candidate. The high confidence stems from the clear link between the vulnerability description and the standard LDAP authentication implementation patterns in Keycloak.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | maven | >= 7.0.0, <= 7.0.1 |