Repository navigation
Multi-Factor Authentication Enrollment Vulnerability #8640
Replies: 2 comments 2 replies
|
Hi! Is it about a normal user beeing able to delete another ones 2FA from the normal account-console? - I tried to replicate it:
I got a proper Or do you mean from the admin-console? A Admin does have all permissions, so I guess that is wanted behaviour. If this would be disabled, a admin could still eg. press the Impersonation-Button and reset the credentials there. God bless! |
|
Thanks for the quick reply. Since this a suspected vulnerability I sent a mail with the subject Multi-Factor Authentication Enrollment Vulnerability as mentioned in this page https://github.com/keycloak/keycloak/security/policy. Hopefully we can continue the discussion there. Thanks in advance. |
|
@Hashan1100 hi, this is not the correct place to report suspected vulnerabilities, please disclose such issues in a responsible way. For more details look at the security policy attached here, which you can also find on our website. |
|
Noted. I followed the instructions in this page https://github.com/keycloak/keycloak/security/policy. And sent a mail. |
Uh oh!
There was an error while loading. Please reload this pa 8000 ge.
Multi-Factor Authentication Enrollment. Another user is able to delete the Configured MFA Authentication of another user as long as the credential Id is known. Is there away to avoid this vulnerability. If not is it possible to fix this in a future release.
All reactions