-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing LDAP bind validation after password resets. Keycloak's LDAP integration uses storage providers (LDAPStorageProvider) and identity stores (LDAPIdentityStore) to manage credentials. The password update workflow likely flows through these components. The absence of an explicit bind operation in these functions after modifying credentials would leave AD policy enforcement gaps. While exact code isn't available, these are core components handling credential updates in LDAP federation, aligning with the described vulnerability mechanism.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-ldap-federation | maven | >= 26.1.0, < 26.1.3 | 26.1.3 |
| org.keycloak:keycloak-ldap-federation | maven | < 26.0.10 | 26.0.10 |
Ongoing coverage of React2Shell