Description (CNA)
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Keycloak / keycloak | affected 8.0.2; affected 9.0.0 |
CWE
CWE-285
References
ADP enrichment
No English description supplied.