-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-quarkus-server | maven | < 26.0.8 | 26.0.8 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability stems from unrestricted use of StringPropertyReplacer.replaceProperties in user-configurable URL processing and SAML configuration parsing. Key functions in ResourceAdminManager (resolveUri, getBackchannelLogoutUrl) directly handled admin-configured URLs with property replacement, enabling the exploit. KeyParser and StaxParserUtil methods processed configuration values without allowed variable restrictions. The commit patches these areas by removing property replacement in URLs or enforcing filtering via SystemEnvProperties.UNFILTERED, confirming these were the vulnerable points.
KEV Misses 88% of Exploited CVEs- Get the report