CVE-2016-8629: Medium severity redhat keycloak vulnerability
https://issues.jboss.org/browse/KEYCLOAK-3667
Other sources
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8629?
CVE-2016-8629 is rated as a high severity vulnerability due to its potential for unauthorized user deletion.
How do I fix CVE-2016-8629?
To fix CVE-2016-8629, upgrade Red Hat Keycloak to version 2.4.0 or later.
What types of systems are affected by CVE-2016-8629?
CVE-2016-8629 affects Red Hat Keycloak versions before 2.4.0 and Red Hat Single Sign-On versions 7.1 and 7.2.
Can CVE-2016-8629 be exploited remotely?
Yes, CVE-2016-8629 can be exploited remotely by an attacker with service account authentication.
What are the consequences of an exploit of CVE-2016-8629?
Exploiting CVE-2016-8629 allows an attacker to bypass permissions and delete users across different realms.