Description
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| redhat.com | Keycloak | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.11-2.redhat_00001.1.el7sso | RHSA-2023:7484, RHSA-2023:7483, RHSA-2023:7482 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 22.0.1 | 22.0.1 | GHSA-c7xw-p58w-h6fj |
Advisories 4
- RHSA-2023:7483 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7484 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:7482 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.6 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2023-0036 Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Nov 26, 2023