MEDIUM 4.7 Maven
Keycloak users may be able to remove MFA from other users' devices
GHSA-9695-w6h2-jpv9 · CVE-2020-10686
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.
Ready to move
Start Securing
Free, no credit card | First findings in minutes