CVE-2023-4918: Keycloak Core - Plaintext Storage of User Password
Summary
CVE-2023-4918: Keycloak vulnerable to Plaintext Storage of User Password. Affects org.keycloak:keycloak-core versions >= 22.0.2, < 22.0.3. Fixed in 22.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak Core is a package that provides authentication and authorization services for applications. It is commonly used to secure web applications and APIs. The package allows users to register themselves through a registration flow, where they provide their personal information, including a password. However, a flaw in the package allows the passwords of self-registered users to be stored in plaintext as attributes associated with the user. This means that any entity with proper rights or roles can retrieve the passwords in clear-text format.
Vulnerability Detail
The vulnerability in Keycloak Core allows passwords for self-registered users to be stored as cleartext attributes associated with the user. This means that any entity with the necessary rights or roles can access and retrieve the passwords in plain text. The impact of this vulnerability is significant as it exposes sensitive user information and compromises the security of the application. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
22.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Disabling self-registration is the recommended approach until a patched version is available.
Conclusion
The vulnerability in Keycloak Core allows passwords for self-registered users to be stored in plaintext, compromising the security of the application. To mitigate this vulnerability, it is recommended to disable self-registration and update to a patched version of Keycloak Core. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
The impact of this vulnerability is significant as it allows any entity with proper rights or roles to retrieve user passwords in clear-text format. This compromises the security of the application and exposes sensitive user information.
To mitigate this vulnerability, it is recommended to disable self-registration for users in all realms until a patched version of Keycloak Core is available. This will prevent new users from registering and storing their passwords in plaintext.
As of the latest information, the fixed version for Keycloak Core is 22.0.3. It is important to update to this version or any subsequent fixed versions to ensure the security of user passwords.
Yes, existing users' passwords can be compromised if an entity with proper rights or roles retrieves the passwords in clear-text format. It is important to take immediate action to mitigate this vulnerability and update to a patched version of Keycloak Core.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-5q66-v53q-pm35/GHSA-5q66-v53q-pm35.json
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
