Keycloak < 26.3.0 Phishing Vulnerability

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(242321);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/21");

  script_cve_id("CVE-2025-7365");
  script_xref(name:"IAVB", value:"2025-B-0114-S");

  script_name(english:"Keycloak < 26.3.0 Phishing Vulnerability");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The version of Keycloak installed on the remote host is prior to 26.3.0. It is, 
therefore, affected by a phishing vulnerability. A flaw was found in Keycloak. When an authenticated attacker attempts 
to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently 
be prompted to 'review profile' information. This vulnerability allows the attacker to modify their email address to
match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email 
address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks 
the verification link, the attacker can gain access to the victim's account.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://github.com/advisories/GHSA-gj52-35xm-gxjh");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Keycloak version to 26.3.0 or later.");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-7365");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/10");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/10");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:keycloak:keycloak");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("keycloak_nix_installed.nbin");
  script_require_keys("installed_sw/Keycloak");

  exit(0);
}

include('vcf.inc');

var app_info = vcf::get_app_info(app:'Keycloak');

var constraints = [
  { 'fixed_version' : '26.3.0' }
];

vcf::check_version_and_report(
    app_info:app_info,
    constraints:constraints,
    severity:SECURITY_WARNING
);