Insecure service configuration In org.keycloak:keycloak-services
Description
Keycloak's improper input validation allows using email as username Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 24.0.1 | ||
maven | 19.0.2 |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2. 3. 4.