Keycloak's improper input validation allows using email as username
Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-3754US | medium5.3 | Exploit | ||
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password r… | ||||
02
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/CVE-2021-3754WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1999196WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4eWEB
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4xWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-3754ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan