Description
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
keycloak
Default version status: unaffected
25.0.0 to < 25.*affected26.0.0 to < 26.0.11affected26.1.0 to < 26.1.*unknown26.2.0 to < 26.2.2affected
Red Hat Red Hat Build of Keycloak
Default version status: unaffected
Red Hat Red Hat build of Keycloak 26.0
Default version status: affected
26.0.11-2 to < *unaffected
Red Hat Red Hat build of Keycloak 26.0
Default version status: affected
26.0-12 to < *unaffected
Red Hat Red Hat build of Keycloak 26.0
Default version status: affected
26.0-13 to < *unaffected