CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

Information disclosure

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

CVE-2023-49594

Information disclosure vulnerability in instipod DuoUniversalKeycloakAuthenticator for Keycloak (version 1.0.7). Talos details show that during initial authentication, the extension redirects via Response.temporaryRedirect to duosecurity.com, causing the browser to send the user’s username and pa...

CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1907 instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability December 23, 2023 CVE Number CVE-2023-49594 SUMMARY An information disclosure vulnerability exists in the challenge functionality of instipod...

CVE-2023-49594: Insertion of Sensitive Information Into Sent Data

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

DuoUniversalKeycloakAuthenticator Security Vulnerability

DuoUniversalKeycloakAuthenticator is a Keycloak authenticator by Michael Kelly Personal Developer. A security vulnerability exists in DuoUniversalKeycloakAuthenticator version 1.0.7, which stems from the presence of an information disclosure vulnerability, where a specially crafted HTTP request...

PT-2023-31270 · Duo · Duouniversalkeycloakauthenticator

Name of the Vulnerable Software and Affected Versions: DuoUniversalKeycloakAuthenticator version 1.0.7 Description: An information disclosure vulnerability exists in the challenge functionality of the DuoUniversalKeycloakAuthenticator plugin. A specially crafted HTTP request can lead to a...