CVE-2017-12161: org.keycloak:keycloak-core - Password Reset URL Spoofing
Summary
CVE-2017-12161: Moderate severity vulnerability that affects org.keycloak:keycloak-core. Affects org.keycloak:keycloak-core versions < 3.4.2. Fixed in 3.4.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.keycloak:keycloak-core is a Maven package that provides core functionality for the Keycloak identity and access management system. It is responsible for handling user authentication, authorization, and user management. This package is widely used in various applications and systems that require secure user authentication and access control.
Vulnerability Detail
This vulnerability, identified as CVE-2017-12161, affects versions of keycloak before 3.4.2 final. It allows an attacker to exploit a client-side /etc/hosts entry to spoof a URL in a password reset request. By manipulating the password reset request, an attacker can obtain a valid reset token, potentially leading to information disclosure or further attacks. This vulnerability poses a moderate level of severity and has been assigned CWE-602.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.4.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of org.keycloak:keycloak-core.
Conclusion
The vulnerability CVE-2017-12161 affects org.keycloak:keycloak-core versions before 3.4.2 final. It allows an attacker to spoof a URL in a password reset request, potentially leading to information disclosure or further attacks. To mitigate this vulnerability, it is crucial to upgrade to version 3.4.2 or later of org.keycloak:keycloak-core. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
org.keycloak:keycloak-core is a Maven package that provides core functionality for the Keycloak identity and access management system. It handles user authentication, authorization, and user management.
This vulnerability allows an attacker to spoof a URL in a password reset request, potentially leading to information disclosure or further attacks.
This vulnerability has a moderate severity level.
To fix this vulnerability, it is recommended to upgrade to version 3.4.2 or later of org.keycloak:keycloak-core.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to upgrade to the fixed version of org.keycloak:keycloak-core.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
