Improper authentication in keycloak
Priority LOW 32CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Partial Red Hat: 4 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.
Summary
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Why it matters now
EPSS 0.0111 66th percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-saml-core (Maven): 18.0.0Red Hat: 4 advisoriesRed Hat: 4 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | keycloak | Fixed in v18.0.0 | — | No fix listed | CNA |
| — | org.keycloak:keycloak-saml-core (Maven) | before 18.0.0 | 18.0.0 | Patch available | GHSA-4pc7-vqv5-5r3v |
- keycloak Vendor— Affected Fixed in v18.0.0 Fixed in — No fix listed CNA
- org.keycloak:keycloak-saml-core (Maven) Vendor— Affected before 18.0.0 Fixed in 18.0.0 Patch available GHSA-4pc7-vqv5-5r3v
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* | before 18.0.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign-on:7.5.0:*:*:*:*:*:*:* | 7.5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.8:*:*:*:*:*:*:* | 4.8 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* | 4.9 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
- cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 18.0.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign-on:7.5.0:*:*:*:*:*:*:* Versions 7.5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:-:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
Remediation
- Fix · GHSA-4pc7-vqv5-5r3v org.keycloak:keycloak-saml-core (Maven) Fixed in 18.0.0 Advisory →
Red Hat 4 advisories
- RHSA-2022:0164 Released 2022-01-18 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso75-openshift-rhel8
- RHSA-2022:0155 Released 2022-01-17 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 security update
- RHSSO 7.5.1
- RHSA-2022:0152 Released 2022-01-17 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 security update on RHEL 8
- Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.4-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00001.1.el8sso
Show 1 more Red Hat advisories
- RHSA-2022:0151 Released 2022-01-17 · Red Hat rating ImportantRed Hat Single Sign-On 7.5.1 security update on RHEL 7
- Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.4-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00001.1.el7sso
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat A-MQ Online | Affected | No fix planned: Out of support scope |
| Middleware Containers for OpenShift | Fixed | RHSA-2022:0164 |
| RHSSO 7.5.1 | Fixed | RHSA-2022:0155 |
| Red Hat Single Sign-On 7.5 for RHEL 7 Server | Fixed | RHSA-2022:0151 |
| Red Hat Single Sign-On 7.5 for RHEL 8 | Fixed | RHSA-2022:0152 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3827
- 2026-10-03 Alias added: GHSA-4pc7-vqv5-5r3v
References
Advisory 4
More Red Hat Keycloak vulnerabilities
- TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
- TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
- TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
- TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
- TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
- TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
Sources
- CVE-2021-3827 · CVE Program
- CVE-2021-3827 · NVD
- FIRST EPSS
- GHSA-4pc7-vqv5-5r3v · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3827 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences