A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NRed Hat Keycloak
APPRedhat< 8.0.0Red Hat Single Sign On
APPRedhat7.3
Related vulnerabilities
Brak walidacji nagłówka Host w serwerze Undertow HTTP
Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerabili...
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly val...
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows ...
A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a comple...