CVE-2021-20262CWE-306

A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password

published March 9, 2021

CVSS
—
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2021-03-09T17:19Z
EPSS history
Timeline
  • 09 MAR 17:19Z
    A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password
    cvelistv5