PT-2022-10657 · Red Hat · Keycloak

Michael Kaplan · Published 2022-08-26 · Updated 2024-06-12 · CVE-2021-3754

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak where an attacker can register with a username that is the same as an existing user's email ID. This may cause issues with password recovery emails if the user forgets their password. The problem arises because Keycloak allows the use of email as a username and does not check if an account with that email already exists, leading to potential difficulties in resetting or logging in with the email for the affected user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-670

CWE-20

Related Identifiers

CVE-2021-3754

GHSA-4VC8-PG5C-VG4X

GHSA-J9XQ-J329-2XVG

Affected Products

Keycloak

References · 11

• https://bugzilla.redhat.com/show_bug.cgi?id=1999196 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3754 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2021-3754 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3754 · Security Note
• https://osv.dev/vulnerability/GHSA-j9xq-j329-2xvg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4vc8-pg5c-vg4x · Vendor Advisory
• https://github.com/keycloak/keycloak · Note
• https://github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4x · Note
• https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e · Note
• https://t.me/cibsecurity/48893 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3754 · Note