Incorrect Access Control

2024-04-1805:53:30

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

keycloak

access control

validation

library

authentication

password

attacker

second factor

unauthorized

5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.5%

JSON

org.keycloak, keycloak-services is vulnerable to Incorrect Access Control. The vulnerability is due to inadequate validation of client step-up authentication in the Keycloak library. It allows a password-authenticated attacker to add a false second authentication factor to an account, enabling unauthorized step-up authentication.