Affected: Bitnami: keycloak

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Affected: CleanStart: keycloak

Security vulnerability affects the keycloak package. A flaw was found in the TokenManager component of the Keycloak identity management service.

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und sensible Informationen offenzulegen.