CVE-2023-0105
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jan 11, 2023
- Updated
- Apr 9, 2025
- Reserved
- Jan 6, 2023
Description
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | CISA-ADP |
Weaknesses
- CWE-287 Improper Authentication
Affected Products
| Product | Versions |
|---|---|
Keycloakredhat.com |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.