Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-mq7m-x1g8-87bb
Summary
Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User
# Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gvgg-2r3r-53x7. This link is maintained to preserve external references.

# Original Description
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges.
Aliases
0
alias GHSA-rq4w-cjrr-h8w8
Fixed_packages
0
url pkg:maven/org.keycloak/keycloak-services@26.1.2
purl pkg:maven/org.keycloak/keycloak-services@26.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2dgp-xdrz-q7dv
1
vulnerability VCID-5vwq-aqk5-nkh9
2
vulnerability VCID-7c1j-kcbb-v3f1
3
vulnerability VCID-bhrr-nn9f-7udu
4
vulnerability VCID-by72-dvnw-m3gu
5
vulnerability VCID-cdsa-wmby-ebbq
6
vulnerability VCID-d2rd-6u56-yfd8
7
vulnerability VCID-e4ub-v4ef-affb
8
vulnerability VCID-gnxr-2t9g-4ye4
9
vulnerability VCID-gzz6-md9v-b3em
10
vulnerability VCID-m3uj-4mag-kbf2
11
vulnerability VCID-mku9-3bpp-aqbk
12
vulnerability VCID-nxhc-rp71-hbdk
13
vulnerability VCID-qgbq-s33g-d7af
14
vulnerability VCID-uuf2-u7xh-uuef
15
vulnerability VCID-ver5-9t6m-c3ef
16
vulnerability VCID-w5f1-xryr-fucq
17
vulnerability VCID-x4aw-v76q-vbdc
18
vulnerability VCID-xd7x-aevv-cfcp
19
vulnerability VCID-xfnw-15sz-zyfr
20
vulnerability VCID-y1h3-yyn9-53fr
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.keycloak/keycloak-services@26.1.2
Affected_packages
References
0
reference_url https://access.redhat.com/errata/RHSA-2025:2544
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:2544
1
reference_url https://access.redhat.com/errata/RHSA-2025:2545
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/errata/RHSA-2025:2545
2
reference_url https://access.redhat.com/security/cve/CVE-2025-1391
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://access.redhat.com/security/cve/CVE-2025-1391
3
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2346082
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://bugzilla.redhat.com/show_bug.cgi?id=2346082
4
reference_url https://github.com/keycloak/keycloak
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak
5
reference_url https://github.com/keycloak/keycloak/commit/5aa2b4c75bb474303ab807017582bc01a9f7e378
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/keycloak/keycloak/commit/5aa2b4c75bb474303ab807017582bc01a9f7e378
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2025-1391
reference_id
reference_type
scores
0
value 5.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2025-1391
7
reference_url https://github.com/advisories/GHSA-rq4w-cjrr-h8w8
reference_id GHSA-rq4w-cjrr-h8w8
reference_type
scores
0
value MODERATE
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-rq4w-cjrr-h8w8
Weaknesses
0
cwe_id 284
name Improper Access Control
description The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score4.0 - 6.9
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-mq7m-x1g8-87bb