-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-parent | maven | < 19.0.2 | 19.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from three key issues: 1) The isScriptForSpi method in KeycloakProcessor failed to properly distinguish SAML mappers from other mappers, allowing SAML script uploads even when disabled. 2) ScriptBasedMapper lacked feature flag enforcement, making SAML script execution always available. 3) The new SAML_MAPPERS infrastructure in ScriptProviderDescriptor provided a pathway for script injection that bypassed existing security controls. The commit patched these by introducing SAML_MAPPERS separation, adding feature checks in ScriptBasedMapper, and modifying SPI validation logic in KeycloakProcessor.
KEV Misses 88% of Exploited CVEs- Get the report