CVE-2023-49594: instipod DuoUniversalKeycloakAuthenticator · Information Exposure Through Sent Data
Affects instipod DuoUniversalKeycloakAuthenticatorSource CVE Database V5
Not known to be exploited · CVSS 4.5 Medium.
Data as of 26 Oct 2026, 17:16 UTC
- EPSS
- 1.2% chance of exploitation in 30 days – higher than 69% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 23 Dec 2023
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubinstipod/DuoUniversalKeycloakAuthenticatorpkg:github/instipod/DuoUniversalKeycloakAuthenticatorOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Monitor for updates or patches from instipod for the DuoUniversalKeycloakAuthenticator plugin and apply them promptly once available.
- Restrict access to Keycloak authentication endpoints to trusted networks and users to reduce exposure to crafted HTTP requests.
- Implement strict network segmentation and access controls around identity management infrastructure.
- Conduct regular audits of authentication logs to detect unusual or suspicious login attempts that could indicate exploitation attempts.
- Educate privileged users about the risk of interacting with suspicious authentication prompts or links.
- Consider deploying Web Application Firewalls (WAFs) with rules to detect and block anomalous HTTP requests targeting the authentication challenge endpoints.
- Evaluate alternative 2FA plugins or solutions if patching is delayed, to reduce exposure.
- Ensure that all components of the authentication stack are kept up to date and hardened according to best practices.
Description
An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.