CVE-2021-3754 json
Keycloak's improper input validation allows using email as username
published 2022-08-26 4 y ago modified 2026-06-17 4 mo ago also GHSA-4vc8-pg5c-vg4x , EUVD-2024-1917
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.
Patch / fix
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2021-3754 updated cvss 3.7
keycloak: allows using email as username
-
Red Hat Decision Manager 7 keycloak keycloak Red Hat OpenShift Application Runtimes keycloak keycloak Red Hat Process Automation 7 keycloak keycloak Red Hat Single Sign-On 7 rh-sso7-keycloak rh-sso7-keycloak Red Hat support for Spring Boot keycloak keycloaknot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.19% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.keycloak:keycloak-services | <24.0.1 |
24.0.1 |
Affected products
- n/a keycloak
Classification
References
-
github.com
/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e
web
-
bugzilla.redhat.com
/show_bug.cgi?id=1999196
web, issue-tracking, vendor-advisory
-
access.redhat.com
/security/cve/CVE-2021-3754
web, vendor-advisory
-
github.com
/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4x
web
-
nvd.nist.gov
/vuln/detail/CVE-2021-3754
advisory
-
github.com
/keycloak/keycloak
package
Sources
- CVE List CVE-2021-3754
- GitHub Advisory GHSA-4vc8-pg5c-vg4x
- NVD CVE-2021-3754
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.