keycloak vulnerable to unauthorized login via mail server setup

2022-05-2417:05:43

Google

osv.dev

keycloak

unauthorized login

mail server

flaw

version 8.0.0

domain

password reset

client name

email address

EPSS

0.002

Percentile

61.9%

JSON

A flaw was found in keycloack before version 8.0.0. The owner of ‘placeholder.org’ domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name ‘test’ the email address will be ‘[email protected]’.