Description
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC) by requesting a server ticket. This allows an attacker on the same network to spoof the KDC and bypass the authentication process, potentially gaining unauthorized access to user accounts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Build of Keycloak
Default version status: affected
Red Hat Red Hat Build of Keycloak
Default version status: affected
Red Hat Red Hat Build of Keycloak
Default version status: affected
Red Hat Red Hat Single Sign-On 7
Default version status: affected