GHSA-9695-w6h2-jpv9

ghsaUSosv

Keycloak users may be able to remove MFA from other users' devices

view advisory published 2022-05-24Licence: CC-BY-4.0

A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-10686US	medium4.7	0.65% (51st)	—	2020-05-04
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove d…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686WEB
https://github.com/keycloak/keycloakPACKAGE
https://github.com/keycloak/keycloak/commit/5ddd605ee96b8551c7eb00b609a0b97939925b77WEB
https://nvd.nist.gov/vuln/detail/CVE-2020-10686ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan