A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This could lead to unauthorized access or account compromise.
| Vendor | Product | Versions |
|---|---|---|
| red hat | red hat build of keycloak | — |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | keycloak | cert_advisory | 90% |
| red hat | red hat enterprise linux | cert_advisory | 90% |
Updated severity to HIGH, CVSS estimate to 7.5, and added CVE ID tag.
Initial creation
