-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) Error messages revealed whether an account was locked vs having invalid credentials (CWE-209), and 2) Authentication flow allowed password validation before checking lock status (CWE-522). The GitHub PR #7976 shows these were fixed by a) making error messages generic for locked accounts regardless of password validity, and b) adding early account status checks. The identified functions are core authentication handlers where these flawed checks would logically occur based on Keycloak's architecture and the patch's focus on user status validation and error message unification.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | maven | < 13.0.0 | 13.0.0 |
Ongoing coverage of React2Shell