Keycloak: leak of configured ldap bind credentials through the keycloak admin console

Summary

A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL  independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.

Timeline

1. Jun 18, 2024, 12:05 PM UTCCVE published
2. Jun 18, 2024, 3:10 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Mar 26, 2026, 11:13 PM UTCRecord last updated

Affected versions

• keycloak

  fixed in 22.0.12; From 23.0.0 · fixed in 24.0.6; From 25.0.0 · fixed in 25.0.1

• keycloak-core

  Version range not reported

• rhbk/keycloak-operator-bundle

  Version range not reported

• rhbk/keycloak-rhel9

  Version range not reported

• rhbk/keycloak-rhel9-operator

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso7-keycloak

  Version range not reported

• rh-sso-7/sso76-openshift-rhel8

  Version range not reported

• org.keycloak:keycloak-ldap-federationMaven

  From 25.0.0 · fixed in 25.0.1

• org.keycloak:keycloak-ldap-federationMaven

  fixed in 22.0.12

• org.keycloak:keycloak-ldap-federationMaven

  From 23.0.0 · fixed in 24.0.6

References 9