Red Hat build of Keycloak organization login flow allows account takeover
An login server using multi-organization sign-in can let strangers into other people's accounts.
Summary
A flaw in the organization-based identity-first login flow of the Keycloak authentication server lets an attacker who belongs to several organizations take over a victim's account using only the victim's username, gaining access to connected applications.
Affected when
- Organization identity-first login flow in use
What to do
Update to Red Hat build of Keycloak 26.6.8.
Products and platforms
CVE IDs
Sources
Times
First published
First seen