Keycloak: leak of configured ldap bind credentials through the keycloak admin console
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2024-5967
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 13:47 UTC · Revision 1
Source evidence
Keycloak: leak of configured ldap bind credentials through the keycloak admin console
core-osv · Original sourcePublished 18 Jun 2024, 12:05 UTC
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL ("Connection URL") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.
osv:CVE-2024-5967
Complete source record
{
"id": "e25df074a80eeb7b993feb8e16be3eddbe85245966b914608e48581f87120a8b",
"url": "https://osv.dev/vulnerability/CVE-2024-5967",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Keycloak: leak of configured ldap bind credentials through the keycloak admin console",
"summary": "A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permission manage-realm) to change the LDAP host URL (\"Connection URL\") to a machine they control. The Keycloak server will connect to the attacker's host and try to authenticate with the configured credentials, thus leaking them to the attacker. As a consequence, an attacker who has compromised the admin console or compromised a user with sufficient privileges can leak domain credentials and attack the domain.",
"evidence": "osv:CVE-2024-5967",
"products": [],
"severity": "low",
"structured": {
"id": "CVE-2024-5967",
"aliases": [
"CVE-2024-5967",
"GHSA-c25h-c27q-5qpv"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/keycloak/keycloak",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "8dccc90db0b1ed6c885973f2baa86ad8507671f9"
},
{
"introduced": "1d4ce3d8e9dbc9af996f9248996c78e145902a35"
},
{
"fixed": "5a6e01a5b1b6074081628658186812978fcdfadc"
},
{
"introduced": "5279b7f4530afc3c05699a2d8bbcdd18f557b6a9"
},
{
"fixed": "6a22f31b812ce68735373b1a0b047b75958f0b64"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "22.0.12"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "23.0.0"
},
{
"fixed": "24.0.6"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "25.0.0"
},
{
"fixed": "25.0.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"2.4.0.Test",
"1.3.0.Final",
"1.1.0.Beta2",
"1.0.0.Final",
"1.0-final",
"1.0-rc-1",
"1.0-beta-4",
"1.0-beta-2",
"1.0-beta-1",
"1.0-alpha-3",
"1.0-alpha-2",
"1.0-alpha-1",
"1.0-alpha-1-12062013"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5967.json"
}
}
],
"modified": "2026-10-28T02:30:35.865056437Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://catalog.redhat.com/software/containers/",
"https://access.redhat.com/errata/RHSA-2024:6493",
"https://access.redhat.com/errata/RHSA-2024:6494",
"https://access.redhat.com/errata/RHSA-2024:6495",
"https://access.redhat.com/errata/RHSA-2024:6497",
"https://access.redhat.com/errata/RHSA-2024:6499",
"https://access.redhat.com/errata/RHSA-2024:6500",
"https://access.redhat.com/errata/RHSA-2024:6501",
"https://access.redhat.com/security/cve/CVE-2024-5967",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5967.json",
"https://nvd.nist.gov/vuln/detail/CVE-2024-5967",
"https://bugzilla.redhat.com/show_bug.cgi?id=2292200",
"https://github.com/keycloak/keycloak"
],
"provider_metadata": {
"cwe_ids": [
"CWE-276"
],
"cna_assigner": "redhat",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"fixed": "22.0.12-1"
},
{
"fixed": "22-17"
},
{
"fixed": "22-20"
},
{
"fixed": "0:18.0.16-1.redhat_00001.1.el7sso"
},
{
"fixed": "0:18.0.16-1.redhat_00001.1.el8sso"
},
{
"fixed": "0:18.0.16-1.redhat_00001.1.el9sso"
},
{
"fixed": "7.6-52"
}
],
"source": "AFFECTED_FIELD",
"strategy": "InverseAffectedRanges"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/5xxx/CVE-2024-5967.json"
}
},
"related_cves": [
{
"value": "CVE-2024-5967",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 503289,
"published_at": "2024-06-18T12:05:39.289+00:00"
}