CVEvulnerability
CVE-2021-4133
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-01-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-863
Description
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
Affected configurations
• redhat keycloak (>= 12.0.0 < 15.1.1)
Related
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2033602 Issue Tracking, Third Party Advisory
- https://github.com/keycloak/keycloak/issues/9247 Third Party Advisory
- https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Not Applicable
- https://bugzilla.redhat.com/show_bug.cgi?id=2033602 Issue Tracking, Third Party Advisory
- https://github.com/keycloak/keycloak/issues/9247 Third Party Advisory
- https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Not Applicable