VDB
Sign up
HIGH7.4

GHSA-m6q9-p373-g5q8

Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

Quick fix

GHSA-m6q9-p373-g5q8 — org.keycloak:keycloak-services: upgrade to the fixed version with the command below.

# pom.xml: bump <version>22.0.10</version> for org.keycloak:keycloak-services

Details

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

#### Acknowledgements Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.keycloak:keycloak-services
Introduced in: 0Fixed in: 22.0.10
Fix# pom.xml: bump <version>22.0.10</version> for org.keycloak:keycloak-services
Maven/org.keycloak:keycloak-services
Introduced in: 23.0.0Fixed in: 24.0.3
Fix# pom.xml: bump <version>24.0.3</version> for org.keycloak:keycloak-services

References