CVE-2021-4133

Name of the Vulnerable Software and Affected Versions Keycloak versions 12.0.0 through 15.1.1

Description A flaw was found in Keycloak that allows an attacker with any existing user account to create new default user accounts via the administrative REST API, even when new user registration is disabled.

Recommendations For Keycloak versions 12.0.0 through 15.1.1, consider disabling the administrative REST API until a patch is available. Restrict access to the administrative REST API to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.