CVE-2020-27826

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 12.0.0

Description: A flaw was found in Keycloak where it is possible to update the user's metadata attributes using the Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

Recommendations: For versions prior to 12.0.0, update to version 12.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Account REST API to minimize the risk of exploitation. Avoid using the NameID attribute in the affected API endpoint until the issue is resolved.