-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-core | maven | < 15.1.0 | 15.1.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability arises because the WebAuthnPasswordlessAuthenticatorFactory in Keycloak versions <15.1.0 did not override the isUserSetupAllowed method inherited from its parent class (likely WebAuthnAuthenticatorFactory). This parent method allowed user setup (device registration) during authentication by default. Attackers exploited this by triggering the passwordless login flow for users without registered devices, forcing the registration of a new device and hijacking the account. The fix explicitly overrides isUserSetupAllowed in WebAuthnPasswordlessAuthenticatorFactory to return false, blocking this vector. The vulnerable function is the parent class's isUserSetupAllowed, which remained active in the absence of the override.
Ongoing coverage of React2Shell