-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from Keycloak's failure to properly segregate username and email uniqueness checks. Key evidence comes from the reproduction steps showing that registering with a victim's username as an email creates a blocking conflict. The UserProfile.validate() function is central to registration validation, and IdentityBrokerService.createUser() handles user creation - both would be involved in the flawed uniqueness checks. The high confidence for UserProfile.validate() comes from its direct role in profile validation, while medium confidence for IdentityBrokerService.createUser() reflects its position in the user creation workflow without direct code access.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-core | maven | <= 23.0.5 | 24.0.0 |
KEV Misses 88% of Exploited CVEs- Get the report