CVE-2020-35509

2022-08-2315:53:02

CWE-20

redhat

www.cve.org

keycloak

authentication

vulnerability

data confidentiality

integrity

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

CNA Affected

[
  {
    "product": "keycloak",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "11.0.3, 12.0.0"
      }
    ]
  }
]