CVE-2023-49594

Information disclosure vulnerability in instipod DuoUniversalKeycloakAuthenticator for Keycloak (version 1.0.7). Talos details show that during initial authentication, the extension redirects via Response.temporaryRedirect to duosecurity.com, causing the browser to send the user’s username and pa...

instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1907 instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability December 23, 2023 CVE Number CVE-2023-49594 SUMMARY An information disclosure vulnerability exists in the challenge functionality of instipod...