Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Keycloak: Email Impersonation and Lockout via Email Address

CVE-2023-0105 · published 3 years ago
Summary

Keycloak's email address handling is flawed, allowing an attacker to lock out or impersonate a legitimate user with the same email address. This could lead to unauthorized access to user accounts and sensitive information. To fix this, update Keycloak to the latest version.

What to do
  • Update keycloak org.keycloak:keycloak-core to version 22.0.1.
Affected software
Ecosystem VendorProductAffected versions
maven keycloak org.keycloak:keycloak-core < 22.0.1
Fix: upgrade to 22.0.1
– redhat keycloak All versions
cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*
Original advisory text
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and l...
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-287Improper Authentication
CWE-841Improper Enforcement of Behavioral Workflow
Timeline
Published13 Jan 2023
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-c7xw-p58w-h6fj · GHSA
CVE-2023-0105 · NVD
Track software like this
Free during beta