Description
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Keycloak | keycloak 15.1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.2-3.redhat_00002.1.el7sso | RHSA-2022:0152, RHSA-2022:0151, RHSA-2021:5219 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-services | < 15.1.1 | 15.1.1 | GHSA-83x4-9cwr-5487 |
Advisories 4
- RHSA-2022:0152 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:0151 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2021:5219 Red Hat Security Advisory: Red Hat Single Sign-On security update on RHEL 8 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2021:5218 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.0 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026