CVE-2021-4133: Improper Authorization in Keycloak
Summary
CVE-2021-4133: Improper Authorization in Keycloak. Affects org.keycloak:keycloak-services versions < 15.1.1. Fixed in 15.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak is an open-source identity and access management solution that provides single sign-on, social login, and user federation capabilities. It is widely used to secure web applications and services. The Keycloak 12.0.0 version is affected by an improper authorization vulnerability that allows attackers with existing user accounts to create new default user accounts via the administrative REST API, even when new user registration is disabled.
Vulnerability Detail
The vulnerability in Keycloak 12.0.0 arises from an incorrect authorization flaw. Attackers who possess any existing user account can exploit this flaw to create new default user accounts using the administrative REST API, regardless of whether new user registration is enabled or disabled. This unauthorized account creation can lead to various security risks, such as unauthorized access, privilege escalation, and potential data breaches.
How To Fix
Latest published version: 26.8.1 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.1.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Keycloak to address the issue effectively.
Conclusion
The improper authorization vulnerability in Keycloak 12.0.0 allows attackers with existing user accounts to create new default user accounts via the administrative REST API, bypassing any restrictions on new user registration. To mitigate this vulnerability, it is crucial to upgrade Keycloak to version 15.1.1 or later. For further assistance or support in vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-services →
FAQ
Keycloak is an open-source identity and access management solution that provides single sign-on, social login, and user federation capabilities.
The vulnerability allows attackers with existing user accounts to create new default user accounts via the administrative REST API, bypassing any restrictions on new user registration. This can lead to unauthorized access, privilege escalation, and potential data breaches.
To fix this vulnerability, it is recommended to upgrade Keycloak to version 15.1.1 or later, as it includes a fix for the improper authorization flaw.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version of Keycloak is the recommended solution.
For more information about this vulnerability, you can refer to the CVE-2021-4133 advisory or contact the Keycloak support team.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-services.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
