Input validation error in Keycloak - CVE-2021-3754

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can register himself with the username same as the email ID of any existing user and perform a denial of service (DoS) attack.

Affected software

How to mitigate CVE-2021-3754

Links to Public Exploits and PoC-codes

• Exploit #9302 - CVE-2021-3754 (Vulnerability details and exploit for CVE-2021-3754) (September 8, 2023)

External References

• https://access.redhat.com/security/cve/CVE-2021-3754
• https://bugzilla.redhat.com/show_bug.cgi?id=1999196
• https://github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4x

Related Security Bulletins

• Multiple vulnerabilities in IBM i Modernization Engine for Lifecycle Integration
• Improper input validation in Keycloak