Improper Authentication Affecting org.keycloak:keycloak-services package, versions [,26.2.2)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.05% (16th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authentication vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGKEYCLOAK-9919787
  • published2 May 2025
  • disclosed30 Apr 2025
  • creditMarek Posolda

Introduced: 30 Apr 2025

NewCVE-2025-3910  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade org.keycloak:keycloak-services to version 26.2.2 or higher.

Overview

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Authentication. An attacker can circumvent required actions configured by an administrator such as setting up 2FA by using AIA (Application-initiated actions). If a user account has been required by an administrator to perform a required action, the same user can pass in a URL parameter during the sign in process to exploit this vulnerability.

CVSS Base Scores

version 4.0
version 3.1