Read the docs
TI-2021-03009 Aliases CVE-2021-4133GHSA-83x4-9cwr-5487

Incorrect authorization in Keycloak

Priority MEDIUM 41CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Why it matters now

EPSS 0.01373 72nd percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-services (Maven): 15.1.1Red Hat: 9 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Keycloakkeycloak 15.1.1—No fix listedCNA
—org.keycloak:keycloak-services (Maven)before 15.1.115.1.1Patch availableGHSA-83x4-9cwr-5487
  • Keycloak Vendor— Affected keycloak 15.1.1 Fixed in — No fix listed CNA
  • org.keycloak:keycloak-services (Maven) Vendor— Affected before 15.1.1 Fixed in 15.1.1 Patch available GHSA-83x4-9cwr-5487

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*12.0.0 to before 15.1.1VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions 12.0.0 to before 15.1.1 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-83x4-9cwr-5487 org.keycloak:keycloak-services (Maven) Fixed in 15.1.1 Advisory →

Red Hat 9 advisories

  • RHSA-2022:0164 Released 2022-01-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso75-openshift-rhel8
  • RHSA-2022:0155 Released 2022-01-17 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update
    • RHSSO 7.5.1
  • RHSA-2022:0152 Released 2022-01-17 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update on RHEL 8
    • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.4-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00001.1.el8sso
Show 6 more Red Hat advisories
  • RHSA-2022:0151 Released 2022-01-17 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.1 security update on RHEL 7
    • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.4-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-15.0.4-1.redhat_00001.1.el7sso
  • RHSA-2022:0034 Released 2022-01-05 · Red Hat rating Important
    security update of rh-sso-7/sso75 container images for IBM P/Z
    • Middleware Containers for OpenShift rh-sso-7/sso7-rhel8-operator-bundle
  • RHSA-2022:0015 Released 2022-01-04 · Red Hat rating Important
    security update of rh-sso-7/sso75 container images
    • Middleware Containers for OpenShift rh-sso-7/sso7-rhel8-operator-bundle, rh-sso-7/sso75-openshift-rhel8
  • RHSA-2021:5218 Released 2021-12-20 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.0 security update on RHEL 7
    • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.2-3.redhat_00002.1.el7sso, rh-sso7-keycloak-server-15.0.2-3.redhat_00002.1.el7sso
  • RHSA-2021:5219 Released 2021-12-20 · Red Hat rating Important
    Red Hat Single Sign-On security update on RHEL 8
    • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.2-3.redhat_00002.1.el8sso, rh-sso7-keycloak-server-15.0.2-3.redhat_00002.1.el8sso
  • RHSA-2021:5217 Released 2021-12-20 · Red Hat rating Important
    Red Hat Single Sign-On 7.5.0 security update
    • RHSSO 7.5 async for CVE-2021-4133

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Middleware Containers for OpenShiftFixed RHSA-2022:0015, RHSA-2022:0034, RHSA-2022:0164
RHSSO 7.5 async for CVE-2021-4133Fixed RHSA-2021:5217
RHSSO 7.5.1Fixed RHSA-2022:0155
Red Hat Single Sign-On 7.5 for RHEL 7 ServerFixed RHSA-2021:5218, RHSA-2022:0151
Red Hat Single Sign-On 7.5 for RHEL 8Fixed RHSA-2021:5219, RHSA-2022:0152
Not affected: 1 product
  • Red Hat A-MQ Online

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4133
  2. 2026-10-03 Alias added: GHSA-83x4-9cwr-5487

References

Advisory 4

Other 2

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences