Description

A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=1765129

https://issues.redhat.com/browse/KEYCLOAK-16550

Related Vulnerabilities

CVE-2021-45456 Vulnerability in maven package org.apache.kylin:kylin-server-base

CVE-2017-16017 Vulnerability in npm package sanitize-html

CVE-2013-2165 Vulnerability in maven package org.richfaces.framework:richfaces-impl

CVE-2023-29003 Vulnerability in npm package @sveltejs/kit

CVE-2021-3803 Vulnerability in npm package nth-check

Severity

Medium

Classification

CWE-863 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Issue Tracking Vendor Advisory Permissions Required