Vulnerability Description
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Keycloak | < 18.0.0 |
| Redhat | Single Sign-On | 7.0 |
| Redhat | Enterprise Linux | 7.0 |
| Redhat | Openshift Container Platform | 4.8 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/security/cve/CVE-2021-3827Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2007512Issue TrackingVendor Advisory
- https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cPatchThird Party Advisory
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3vThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-3827Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2007512Issue TrackingVendor Advisory
- https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cPatchThird Party Advisory
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3vThird Party Advisory
FAQ
What is CVE-2021-3827?
CVE-2021-3827 is a vulnerability with a CVSS score of 6.8 (MEDIUM). A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending...
How severe is CVE-2021-3827?
CVE-2021-3827 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-3827?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Keycloak, Redhat Single Sign-On, Redhat Enterprise Linux, Redhat Openshift Container Platform.