CVE-2021-3827

Katalog CVE

CVSS 6.8 · Medium EPSS 1,1%

Kerentanan Improper Authentication pada redhat keycloak, redhat single sign-on +1 lainnya. Skor CVSS 3.1 6.8 (Medium) menurut NVD.

Deskripsi (NVD)

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.

Rincian

Terbit di NVD

23 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-3827 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2007512 issue tracking · advisory vendor
• https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d patch · advisory pihak ketiga
• https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v advisory pihak ketiga