Keycloak Authentication Bypass Vulnerability Due to Missing LDAP Validation After Password Reset

An authentication bypass vulnerability has been identified in Keycloak. When an Active Directory (AD) user resets their password, Keycloak updates the password without validating the new credentials through an LDAP bind. This oversight allows users with expired or disabled AD accounts to regain access in Keycloak, circumventing AD restrictions. The vulnerability could lead to unauthorized access under certain conditions.

Impact

Exploitation of this vulnerability allows for authentication bypass, potentially leading to unauthorized access in Keycloak.

Remediation

Users can upgrade to the Red Hat build of Keycloak 26.0.10, which addresses this vulnerability. Instructions for applying the update are available on the Red Hat Customer Portal.