What’s Vulnerable › Vulnerabilities

CVE-2021-3754

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-26 · updated 2026-06-17
• Weakness: CWE-20

Description

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.

Affected products

• Keycloak: all versions
• Red Hat Single Sign-On: 7.0

References

• https://access.redhat.com/security/cve/CVE-2021-3754
• https://bugzilla.redhat.com/show_bug.cgi?id=1999196
• https://access.redhat.com/security/cve/CVE-2021-3754
• https://bugzilla.redhat.com/show_bug.cgi?id=1999196

Get alerted when CVE-2021-3754 or the next vulnerability affects your stack