Improper Authentication in Keycloak - CVE-2024-10039
Published: November 25, 2024
Vulnerability identifier: #VU100910
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-10039
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in the authentication process in the Keycloak deployments with a reverse proxy not using pass-through termination of TLS and with enabled mTLS. A remote attacker can authenticate as any user or client that leverages mTLS as the authentication mechanism.
Affected software
Keycloak
Red Hat build of Keycloak
Red Hat build of Keycloak
How to mitigate CVE-2024-10039
Install updates from vendor's website.
Keycloak - update to 26.0.6
Red Hat build of Keycloak - addressed in versions 24.0.9, 26.0.6
Red Hat build of Keycloak - addressed in versions 24.0.9, 26.0.6