CVE-2023-3597

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in the client step-up authentication mechanism, where it does not correctly validate authentication. This allows a remote user authenticated with a password to register a false second authentication factor alongside an existing one, bypassing authentication. The issue is related to the org.keycloak.authentication module.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.