CVE-2023-3597 Keycloak: secondary factor bypass in step-up authentication

2024-04-2512:20:11

CWE-287

redhat

github.com

keycloak

authentication flaw

secondary factor

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

AI Score

7.3

Confidence

Low

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to register a false second authentication factor along with an existing one and bypass authentication.