GHSA-c7xw-p58w-h6fj
Keycloak: Impersonation and lockout possible through incorrect handling of email trust
At a glance
- Published
- Updated
- CVE
- CVE-2023-0105
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Description
Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-core | introduced 0, fixed 22.0.1 |
References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj WEB
- https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988 WEB
- https://access.redhat.com/security/cve/CVE-2023-0105 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2158910 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |