CVE-2021-20202: Temporary Directory Hijacking Vulnerability in Keycloak
Summary
CVE-2021-20202: Temporary Directory Hijacking Vulnerability in Keycloak. Affects org.keycloak:keycloak-core versions < 13.0.0. Fixed in 13.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, user federation, and social login integration. The keycloak-core package is a core component of Keycloak that handles authentication and authorization processes. Unfortunately, this package is vulnerable to a temporary directory hijacking vulnerability.
Vulnerability Detail
The vulnerability in keycloak-core allows an attacker to create directories with wider user permissions in the temporary directory before the Java process creates them. This grants the attacker access to the contents stored by Keycloak in this directory. The primary threat posed by this vulnerability is the potential compromise of data confidentiality and integrity.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
13.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, you can implement a workaround by manually adjusting the permissions of the temporary directory used by Keycloak. Ensure that the directory is only accessible by the Java process and restrict wider user permissions. Here is an example of how to set the appropriate permissions using the command line:
$ chmod 700 /path/to/temporary_directory
Conclusion
In conclusion, the keycloak-core package in Keycloak is vulnerable to a temporary directory hijacking vulnerability. Upgrading to version 13.0.0 or later is recommended to fix this issue. If immediate upgrade is not possible, manually adjusting the permissions of the temporary directory can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that helps organizations secure their applications and services. It provides features such as single sign-on, user federation, and social login integration.
The vulnerability allows an attacker to gain access to the contents stored by Keycloak in the temporary directory. This can lead to the compromise of data confidentiality and integrity.
To fix this vulnerability, upgrade the keycloak-core package to version 13.0.0 or later. This version includes the necessary patches to prevent temporary directory hijacking.
Yes, if upgrading immediately is not possible, you can manually adjust the permissions of the temporary directory used by Keycloak. Ensure that the directory is only accessible by the Java process and restrict wider user permissions.
For more information about this vulnerability, you can refer to the CVE identifier CVE-2021-20202 or visit the Vulert Playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
