GitHub Advisoryadvisory · Maven

GHSA-83x4-9cwr-5487 Improper Authorization in Keycloak

HIGH Published 2022-01-06 Modified 2022-02-02 Official page ↗
Aliases
CVE-2021-4133
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-863
Reviewed
2022-01-04

Affected packages

• Maven org.keycloak:keycloak-services: < 15.1.1 → fixed in 15.1.1

Description

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.

Related

Alias · CVE (1)

  • CVE-2021-4133 A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create… vulnerability

Weakness · CWE (1)

  • CWE-863 Incorrect Authorization weakness

References