GitHub Advisoryadvisory · Maven

GHSA-9695-w6h2-jpv9 Keycloak users may be able to remove MFA from other users' devices

MEDIUM Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2020-10686
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-285
Reviewed
2024-04-23

Affected packages

• Maven org.keycloak:keycloak-core: < 9.0.2 → fixed in 9.0.2

Description

A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.

Related

Alias · CVE (1)

  • CVE-2020-10686 A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References