Improper authorization control for web services In org.keycloak:keycloak-core
Description
Keycloak users may be able to remove MFA from other users' devices A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 9.0.2 | ||
maven | 9.0.2 | ||
 npm | 9.0.2 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.