CVE-2021-3632: Improper Authentication

August 26, 2022 (updated November 23, 2022)

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.

References

access.redhat.com/security/cve/CVE-2021-3632
bugzilla.redhat.com/show_bug.cgi?id=1978196
github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
github.com/keycloak/keycloak/pull/8203
issues.redhat.com/browse/KEYCLOAK-18500
nvd.nist.gov/vuln/detail/CVE-2021-3632

Code Behaviors & Features

Detect and mitigate CVE-2021-3632 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →