GHSA-9695-w6h2-jpv9
Keycloak users may be able to remove MFA from other users' devices
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 9.0.2 | 9.0.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.
References
External links from the advisory. They lead to third-party sites.