What’s Vulnerable › Vulnerabilities

CVE-2022-1466

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-26 · updated 2026-06-17
• Weakness: CWE-863

Description

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.

Affected products

• Keycloak: before 17.0.1 — fixed in 17.0.1
• Red Hat Single Sign-On: 7.5.0

How to fix

Upgrade to a fixed version: Keycloak 17.0.1. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2050228
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-076.txt
• https://www.syss.de/pentest-blog/fehlerhafte-autorisierung-bei-red-hat-single-sign-on-750ga-syss-2021-076
• https://bugzilla.redhat.com/show_bug.cgi?id=2050228
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-076.txt
• https://www.syss.de/pentest-blog/fehlerhafte-autorisierung-bei-red-hat-single-sign-on-750ga-syss-2021-076

Get alerted when CVE-2022-1466 or the next vulnerability affects your stack