-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-quarkus-server | maven | < 24.0.9 | 24.0.9 |
| org.keycloak:keycloak-quarkus-server | maven | >= 25.0.0, < 26.0.6 | 26.0.6 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of runtime properties during Keycloak's build process. The commit diff shows critical changes to PropertyMappers.java's getValue() method and the removal of PropertyMapper.IDENTITY. The original getValue() method used PropertyMapper.IDENTITY to resolve properties, which did not filter runtime-sensitive values during build-time configuration processing. This allowed environment variables and SPI options to be expanded and embedded into bytecode as defaults. The patch introduced checks for rebuild states and runtime property filtering via isKeycloakRuntime, confirming these functions were the root cause. The test case added in StartCommandDistTest.java further validates that runtime values are no longer captured, aligning with the fixes in these functions.