Threats tagged 'ghsa-jxqv-2jjx-692h'

A vulnerability in the Identity Provider (IdP) mapper component of Keycloak allows an administrator with limited permissions to escalate their privileges. By creating a "Hardcoded Role" mapper, the attacker can assign themselves or others high-level administrative roles such as realm-admin, bypassing security restrictions and gaining full control over the realm. This flaw affects Keycloak and has a CVSS score of 6.5, indicating a medium severity impact. Red Hat has released a security update in Keycloak version 26.6.8 that addresses this and other vulnerabilities.