CVE-2023-49594

Summary

CVE-2023-49594 is an information disclosure vulnerability affecting version 1.0.7 of the instipod DuoUniversalKeycloakAuthenticator plugin. This issue arises from a flaw in the challenge functionality, which can be exploited through a carefully crafted HTTP request. Upon successful exploitation, sensitive information is disclosed. Users logging into Keycloak using the DuoUniversalKeycloakAuthenticator plugin inadvertently trigger this vulnerability, making it a potential threat to security.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.