Vadim Ashikhman

**Name of the Vulnerable Software and Affected Versions** Keycloak versions prior to 8.0.0 **Description** A flaw in Keycloak allows the owner of a domain to set up a mail server and reset a client's password, knowing only the client's name. For instance, a client named 'test' would have an email address like 'service-account-test@placeholder.org'. This issue is related to the use of predefined registration data, which can be exploited by a remote attacker to gain unauthorized access to protected information. **Recommendations** For versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue.