QwikSec

Security Database

CVE

CWE

Training

CVE-2020-27826

Published: May 28, 2021

Modified: Aug 4, 2024

PUBLISHED

Description

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

Vendor	Product	Versions
n/a	keycloak	affected `keycloak 12.0.0`

Weaknesses (CWE)

References

https://bugzilla.redhat.com/show_bug.cgi?id=1905089

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.