HIGH 8.8

GHSA-83x4-9cwr-5487

Improper Authorization in Keycloak

Details

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven / org.keycloak:keycloak-services

Introduced in: 0 Fixed in: 15.1.1

Fix # pom.xml: bump <version>15.1.1</version> for org.keycloak:keycloak-services

References

https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487 [WEB]
https://nvd.nist.gov/vuln/detail/CVE-2021-4133 [ADVISORY]
https://github.com/keycloak/keycloak/issues/9247 [WEB]
https://bugzilla.redhat.com/show_bug.cgi?id=2033602 [WEB]
https://github.com/keycloak/keycloak [PACKAGE]
https://www.oracle.com/security-alerts/cpuapr2022.html [WEB]