CVE-2021-4133

—

CVSS 3.1

8.8 high

EPSS

1%p70

Published

Jan 25, 2022 (Jan 25, 2022)

Modified

Jun 17, 2026

Description

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Vendors: redhat
Products: keycloak
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news0 stories

No ingested article mentions this CVE yet.