Homepage
About Snyk

Cross-Site Request Forgery (CSRF) The advisory has been revoked - it doesn't affect any version of package org.keycloak:keycloak-server-spi-private Open this link in a new tab

    Threat Intelligence

    EPSS
    0.04% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGKEYCLOAK-7247314
  • published 12 Jun 2024
  • disclosed 12 Jun 2024
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 12 Jun 2024

CVE-2024-5203 Open this link in a new tab
CWE-352 Open this link in a new tab

Amendment

This was deemed not a vulnerability.

Overview

org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Cross-Site Request Forgery (CSRF) due to the lack of a unique token sent during the authentication POST request, /login-actions/authenticate. This flaw allows an attacker to craft a malicious login page and trick a legitimate user of an application into authenticating with an attacker-controlled account instead of their own.

Note: This vulnerability is not exploitable and the CVE has been rejected, as "the exploit assumes that the attacker has access to a session code parameter that matches a cookie on the Keycloak server. However the attacker does not have access to the cookie, and can therefore not craft a malicious request."