Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-3827

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.

Published

2022-08-23T16:15:10.030

Last Modified

2024-11-21T06:22:33.163

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.8 (MEDIUM)

Weaknesses

Type: Secondary
CWE-287
Type: Primary
CWE-287

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	keycloak	< 18.0.0	Yes
Application	redhat	single_sign-on	7.0	Yes
Application	redhat	single_sign-on	7.5.0	Yes
Operating System	redhat	enterprise_linux	7.0	No
Operating System	redhat	enterprise_linux	8.0	No
Application	redhat	openshift_container_platform	4.8	Yes
Application	redhat	openshift_container_platform	4.9	Yes
Operating System	redhat	enterprise_linux	8.0	No

References

https://access.redhat.com/security/cve/CVE-2021-3827 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=2007512 Issue Tracking, Vendor Advisory ([email protected])
https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d Patch, Third Party Advisory ([email protected])
https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v Third Party Advisory ([email protected])
https://access.redhat.com/security/cve/CVE-2021-3827 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=2007512 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)