CVE-2021-20262: Medium severity redhat keycloak vulnerability
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Other sources
Re-authentication is missing while updating the password. This may cause account takeover if any attacker get the temporary physical access to a user's browser.
https://issues.redhat.com/browse/KEYCLOAK-17250
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-20262?
CVE-2021-20262 is a vulnerability in Keycloak 12.0.0 that allows an attacker to take over an account if they can obtain temporary physical access to a user's browser.
What is the severity of CVE-2021-20262?
The severity of CVE-2021-20262 is medium with a CVSS score of 6.8.
Which software versions are affected by CVE-2021-20262?
Keycloak 12.0.0 and Single Sign-on 7.0 are affected by CVE-2021-20262.
How do I mitigate the vulnerability CVE-2021-20262?
To mitigate CVE-2021-20262, it is recommended to update Keycloak to version 12.0.4 or apply any relevant patches provided by the vendor.
Where can I find more information about CVE-2021-20262?
You can find more information about CVE-2021-20262 on the NIST National Vulnerability Database, Red Hat Bugzilla, and GitHub Advisories.