CVE-2023-0105: Keycloak: Impersonation and lockout possible through incorrect handling of email trust
Summary
CVE-2023-0105: Keycloak: Impersonation and lockout possible through incorrect handling of email trust. Affects org.keycloak:keycloak-core versions < 22.0.1. Fixed in 22.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. The 'org.keycloak:keycloak-core' package is a core component of Keycloak, responsible for handling various functionalities related to user management and security. This vulnerability affects versions prior to 22.0.1 of the package.
Vulnerability Detail
The vulnerability in Keycloak arises from incorrect handling of email trust. When a user's email is changed, the verified state is not reset. This allows an attacker to impersonate or lock out other users who share the same email. By exploiting this vulnerability, an attacker can gain unauthorized access to user accounts, perform actions on their behalf, or deny them access to their own accounts.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
22.0.1
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the 'org.keycloak:keycloak-core' package to a secure version.
Conclusion
The vulnerability in Keycloak allows for impersonation and lockout attacks due to incorrect handling of email trust. It is crucial to upgrade the 'org.keycloak:keycloak-core' package to version 22.0.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications.
The impacted package is 'org.keycloak:keycloak-core', which is a core component of Keycloak responsible for user management and security.
The vulnerability allows for impersonation and lockout through incorrect handling of email trust, enabling attackers to gain unauthorized access to user accounts or deny access to legitimate users.
The potential consequences include unauthorized access to user accounts, impersonation of users, and denial of access to legitimate users.
To fix this vulnerability, upgrade the 'org.keycloak:keycloak-core' package to version 22.0.1 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
