CVE-2020-10686

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

Score

CVSS 3.1 4.7 Medium

Status

Modified - secalert@redhat.com

Published

2020-05-04

Last modified

2024-08-04

Weaknesses

CWE-285

Affected products

• Keycloak (Keycloak)
• Keycloak (Redhat)

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10686