CVE-2024-5967

Maven/org.keycloak:keycloak-ldap-federation CVE-2024-5967: low 2.7, EPSS 0.65%

Keycloak leaks configured LDAP bind credentials through the Keycloak admin console

Action: Upgrade org.keycloak:keycloak-ldap-federation to 22.0.12 (22.x), 24.0.6 (24.x) or 25.0.1 (25.x) or later.

Affected

Fixed versions

Sources

• osv: GHSA-c25h-c27q-5qpv
• https://github.com/keycloak/keycloak/security/advisories/GHSA-c25h-c27q-5qpv
• https://nvd.nist.gov/vuln/detail/CVE-2024-5967
• https://github.com/keycloak/keycloak/issues/30434
• https://github.com/keycloak/keycloak/commit/0d0530046b9cb4b0d74d2fdefc9bd04f1d20cac0
• https://github.com/keycloak/keycloak/commit/1f56a9e48bf96c3bcb18dfc6cd93e3dd16f281f1
• https://github.com/keycloak/keycloak/commit/bde8568d4174a7072f7c7bb507d2c7d05824b1a6
• https://access.redhat.com/security/cve/CVE-2024-5967
• https://bugzilla.redhat.com/show_bug.cgi?id=2292200
• https://github.com/keycloak/keycloak

CVE-2024-5967 · published 2024-06-21T15:52:38Z · modified 2026-09-10T03:50:15.260606658Z · JSON