Security Advisory
CVE-2020-10686
4.1
MEDIUM
Vulnerability Description
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.
Published Date
May 4, 2020
Official Source
NIST NVD Advisory