CVE-2020-14302

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

Se encontró un fallo en Keycloak versiones anteriores a 13.0.0, donde un proveedor de identidad externo, después de una autenticación con éxito, redirecciona un endpoint hacia Keycloak que acepta múltiples invocaciones con el uso del mismo parámetro "state". Este fallo permite a un usuario malicioso llevar a cabo ataques de reproducción