CVE-2021-4133 | BDVDB-2026-168529 Detail

Keycloak

Description#

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-863 Incorrect Authorization

References#

https://bugzilla.redhat.com/show_bug.cgi?id=2033602
https://github.com/keycloak/keycloak/issues/9247
https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
https://www.oracle.com/security-alerts/cpuapr2022.html

Exploit#

No public exploit known

History#

Version 12022-01-25Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.