Medium severity · published Aug 23, 2022
CVE-2021-3827
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed
6.8
CVSS
1.1%
EPSS
No
On KEV
Description
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Keycloak · Redhat
before 18.0.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.8; 4.9 · source: NVD
SS
Single Sign-on · Redhat
7.0; 7.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3827
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3827
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3827
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=2007512
Patch
https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d
Third Party Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v
More from Keycloak
9.8
CVE-2022-1245
A privilege escalation flaw was found in the token exchange feature of keycloak
9.8
CVE-2019-14910
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case…
9.6
CVE-2021-20195
A flaw was found in keycloak in versions before 13.0.0
9.1
CVE-2022-3782
keycloak: path traversal via double URL encoding
9.1
CVE-2019-14837
A flaw was found in keycloack before version 8.0.0