Nullcon Goa 2025: Your Identity Is Mine: Techniques & Insights From OS Identity Providers Research
About this talk
This session outlines the research process and findings regarding two popular open-source Identity Providers, Keycloak and Authentik, culminating in the discovery of zero-day vulnerabilities (CVE-2024-42490 and CVE-2024-37905). The speaker introduces two innovative research techniques, ORM Leaks and web race conditions, and explores their technical aspects. Security professionals will learn how to utilize these methods to identify vulnerabilities effectively. Additionally, the talk reveals how an initial information leak sparked further investigation, ultimately leading to the development of the ORM Leak technique.
More from this event
See all 30 talks →
Nullcon Goa 2025: Securing the chains: Building defensive layers for software supply chains
38:14
Nullcon Goa 2025 | Large-Scale Exposure Of Orphaned Commits On Major Git Platforms by Kumar Ashwin
26:30
Nullcon Goa 2025 | Panel: Modernizing Security Architecture: Platforms or Best-of-Breed, What Works?
44:47
Nullcon Goa 2025: Panel | Cyber Fusion Center: The Command Center For Integrated Cyber Defense
42:01