CVE-2021-3754

State: Published
Severity: Not scored
Published: Aug 26, 2022
Updated: Aug 3, 2024
Reserved: Aug 31, 2021

Description

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.

Scores

The record has no CVSS score.

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
keycloakn/a	Not-KnownAffected

References

https://bugzilla.redhat.com/show_bug.cgi?id=1999196
https://access.redhat.com/security/cve/CVE-2021-3754

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.