GHSA-4vc8-pg5c-vg4x: Keycloak's improper input validation allows using email as username

June 12, 2024

Keycloak allows the use of email as a username and doesn’t check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.

References

github.com/advisories/GHSA-4vc8-pg5c-vg4x
github.com/keycloak/keycloak
github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e
github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4x

Code Behaviors & Features

Detect and mitigate GHSA-4vc8-pg5c-vg4x with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →