CVE-2021-3827

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	keycloak	Fixed in v18.0.0

References

https://access.redhat.com/security/cve/CVE-2021-3827Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2007512Issue Tracking, Vendor Advisory
https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0dPatch, Third Party Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3vThird Party Advisory
https://access.redhat.com/security/cve/CVE-2021-3827Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2007512Issue Tracking, Vendor Advisory
https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0dPatch, Third Party Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3vThird Party Advisory

Timeline

Published: Aug 23, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-382789.8Tenda AC10-1200 v15.03.06.23_EN was discovered to contain a buffer overflow via the urls parameter in the saveParentControlInfo function.CVE-2021-38287.5nltk is vulnerable to Inefficient Regular Expression Complexity CVE-2021-382837.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to read application log files containing sensitive information CVE-2021-382898.8An issue has been discovered in Novastar-VNNOX-iCare Novaicare 7.16.0 that gives attacker privilege escalation and allows attackers to view CVE-2021-38296.1openwhyd is vulnerable to URL Redirection to Untrusted Site CVE-2021-382908.1A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/librar CVE-2021-382917.5FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df05e1640) suffers from a an assertion failure at src/libavutil/mathematics.c.CVE-2021-382949.8A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior CVE-2021-382957.3In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If CVE-2021-382967.5Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.CVE-2021-382979.8Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH CVE-2021-382989.8Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE.