GHSA-fx44-2wx5-5fvp: Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

April 29, 2025 (updated April 30, 2025)

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references.

Original Description

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.

References

access.redhat.com/errata/RHSA-2025:4335
access.redhat.com/errata/RHSA-2025:4336
access.redhat.com/security/cve/CVE-2025-3910
bugzilla.redhat.com/show_bug.cgi?id=2361923
github.com/advisories/GHSA-fx44-2wx5-5fvp
nvd.nist.gov/vuln/detail/CVE-2025-3910

Code Behaviors & Features

Detect and mitigate GHSA-fx44-2wx5-5fvp with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →