CVE-2024-10451

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 26.0.2

Description Sensitive runtime values, such as passwords, may be captured during the build process and embedded as default values in bytecode, leading to unintended information disclosure. In version 26, sensitive data specified directly in environment variables during the build process is also stored as default values, making it accessible during runtime. Additionally, the indirect use of environment variables for SPI options and Quarkus properties is vulnerable due to unconditional expansion by the PropertyMapper logic, which captures sensitive data as default values.

Recommendations Update Keycloak to version 26.0.2 or later.