Homepage

org.keycloak:keycloak-server-spi-private@26.6.4

  • latest version

    26.7.1

  • first published

    9 years ago

  • latest version published

    8 days ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.keycloak:keycloak-server-spi-private package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Missing Authorization

    org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

    Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated administrator can remove child roles from built-in admin roles by sending name-based composite-role requests against the realm admin API, bypassing the per-role checks that should gate those updates. This can strip essential permissions such as manage-users, manage-clients, or impersonation from administrative roles, disrupting or degrading administrative access within the realm.

    How to fix Missing Authorization?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • M
    Information Exposure

    org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

    Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in services/src/main/java/org/keycloak/services/resources/admin/AuthenticationManagementResource.java. An attacker can retrieve raw authenticator configuration secrets by requesting authentication config data through the admin API as a user with view-only permissions. The vulnerable GET paths return ModelToRepresentation.toRepresentation(config) without masking sensitive entries, so values such as reCAPTCHA secret keys are exposed in the response and can also appear in administrative logs. This leaks third-party service credentials to unauthorized administrators and can expose secrets used by the realm’s authentication flows.

    Notes

    • The leak is limited to the admin GET endpoints that return authenticator-config representations, so only deployments where administrators can view authentication configs through the admin API are exposed.
    • The exposed values are those stored in authenticator config metadata, including provider-defined secrets and legacy/unknown keys that are not recognized as non-secret by the provider registry.

    How to fix Information Exposure?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • L
    Insufficient Granularity of Access Control

    org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

    Affected versions of this package are vulnerable to Insufficient Granularity of Access Control in the group retrieval due to an improper conditional check that fails to apply permission filters when FGAP v2 is enabled. An attacker can access sensitive group metadata and attributes by querying child groups through a parent group endpoint without having the necessary per-child view permissions.

    Note: This is only exploitable if the attacker possesses a delegated administrator role with specific permissions.

    How to fix Insufficient Granularity of Access Control?

    Upgrade org.keycloak:keycloak-server-spi-private to version 26.7.1 or higher.

    [0,26.7.1)
    Go back to all versions of this package