GHSA-83x4-9cwr-5487

Improper Authorization in Keycloak

Source: GitHub Advisory Database (reviewed) High CVE-2021-4133

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.keycloak:keycloak-services	< 15.1.1	15.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.

References

External links from the advisory. They lead to third-party sites.

https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 web
https://nvd.nist.gov/vuln/detail/CVE-2021-4133 advisory
https://github.com/keycloak/keycloak/issues/9247 web
https://bugzilla.redhat.com/show_bug.cgi?id=2033602 web
https://github.com/keycloak/keycloak package
https://www.oracle.com/security-alerts/cpuapr2022.html web