-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 21.0.1 | 21.0.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from two key issues: 1) Code generation in OIDCLoginProtocol.authenticated didn't include user session ID in authorization codes, making them portable across sessions. 2) Code validation in OAuth2CodeParser.parseCode didn't verify session binding. The patch added userSession.getId() to code creation and implemented session ID matching in validation, confirming these were the vulnerable points. The CWE-287 (auth bypass) and CWE-345 (data authenticity) mappings align with these missing security checks.
A Semantic Attack on Google Gemini - Read the Latest Research