CVE-2023-3597

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-3597

CGA ID

CGA-mw98-8pc7-5256

Severity

5.0

Medium

CVSS V3

Summary

Keycloak secondary factor bypass in step-up authentication

Description

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.

References

Affected packages

Advisories are based on vulnerability information provided by Grype from Anchore. Learn how Chainguard creates security advisories.

Safe Source for Open Source™

Media Kit Contact Us

Private Policy

CVE-2023-3597

Severity

Summary

Description

References

Affected packages

Product

Why Chainguard

Customers

Company

Resources