Read the docs
TI-2020-08589 Aliases CVE-2020-10686GHSA-9695-w6h2-jpv9

Improper authorization in keycloak

Priority LOW 23CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

Why it matters now

EPSS 0.00654 51st percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-core (Maven): 9.0.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Keycloakkeycloak8.0.2; 9.0.0—No fix listedCNA
—org.keycloak:keycloak-core (Maven)before 9.0.29.0.2Patch availableGHSA-9695-w6h2-jpv9
  • keycloak VendorKeycloak Affected 8.0.2; 9.0.0 Fixed in — No fix listed CNA
  • org.keycloak:keycloak-core (Maven) Vendor— Affected before 9.0.2 Fixed in 9.0.2 Patch available GHSA-9695-w6h2-jpv9

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:8.0.2:*:*:*:*:*:*:*8.0.2VulnerableRed Hat
cpe:2.3:a:redhat:keycloak:9.0.0:*:*:*:*:*:*:*9.0.0VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:8.0.2:*:*:*:*:*:*:* Versions 8.0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:keycloak:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-9695-w6h2-jpv9 org.keycloak:keycloak-core (Maven) Fixed in 9.0.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-10686
  2. 2026-10-03 Alias added: GHSA-9695-w6h2-jpv9
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 2

Other 2

  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
  • TI-2017-05120 It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens… CVSS 3.0CRITICAL 9.8
  • TI-2017-08952 Weak password recovery in Red Hat Keycloak CVSS 3.0HIGH 8.8
  • TI-2014-03024 The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak… CVSS 3.0HIGH 8.8
  • TI-2026-01295 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users CVSS 3.1HIGH 8.1
  • TI-2017-08950 Insufficient session expiration in Red Hat keycloak CVSS 3.0HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences