Keycloak's improper input validation allows using email as username
Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-3754US | medium5.3 | Exploit | ||
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password r… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/CVE-2021-3754WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1999196WEB
- https://github.com/keycloak/keycloakPACKAGE
- https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4eWEB
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4xWEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-3754ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan