-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability arises from improper handling of StartTLS in LDAP authentication. Keycloak's LDAP connection setup (LDAPUtils.createLDAPConnection) likely fails to enforce proper certificate validation or error handling during StartTLS negotiation, leaving the connection in an insecure state. The password validation function (LDAPIdentityStore.validatePassword) then proceeds with authentication without verifying the TLS-secured bind operation's success. This combination allows invalid passwords to be accepted when StartTLS is misconfigured. The CWEs (278, 295) and symptom description align with these functions' responsibilities in secure connection handling and authentication checks.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | maven | >= 7.0.0, <= 7.0.1 |
JavaJavaKEV Misses 88% of Exploited CVEs- Get the report