CVE-2021-3632

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.

References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type

GIT

Repo

https://github.com/keycloak/keycloak

Events

Introduced

Fixed

843566019e09d15fa0e4778356463bc9a430e965

Introduced

Last affected

e6a274ea0e31c6572e795f3372f006c88122539b

Fixed

65480cb5a11630909c086f79d396004499fbd1e4

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "15.1.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        }
    ]
}

Affected versions

1.*

1.0-alpha-1

1.0-alpha-1-12062013

1.0-alpha-2

1.0-alpha-3

1.0-beta-1

1.0-beta-1-20150521

1.0-beta-1-20150523

1.0-beta-2

1.0-beta-3

1.0-beta-4

1.0-final

1.0-rc-1

1.0-rc-2

1.0.0.Final

1.0.1.Final

1.0.2.Final

1.0.3.Final

1.0.4.Final

1.0.5.Final

1.1.0.Beta1

1.1.0.Beta2

1.1.0.Final

1.1.1.Final

1.2.0.Beta1

1.2.0.CR1

1.2.0.CR1-redhat-1

1.2.0.Final

1.2.0.Final-redhat-1

1.2.0.Final-redhat-2

1.3.0.Final

1.3.1.Final

1.4.0.Final

1.5.0.Final

1.5.0.Final-redhat-1

1.5.1.Final

1.5.1.Final-redhat-1

1.5.1.Final-redhat-2

1.6.0.Final

1.6.0.Final-redhat-1

1.6.1.Final

1.6.1.Final-redhat-1

1.7.0.CR1

1.7.0.CR1-redhat-1

1.7.0.Final

1.7.0.Final-redhat-1

1.8.0.Alpha1

1.8.0.CR1

1.8.0.CR1-redhat-1

1.8.0.CR1-redhat-2

1.8.0.CR2

1.8.0.CR2-redhat-1

1.8.0.CR2-redhat-1-EAP-7

1.8.0.CR3

1.8.0.Final

1.8.0.Final-redhat-1

1.8.1.Final

1.8.1.Final-redhat-1

1.8.2.Final

1.8.2.Final-redhat-1

1.9.0.CR1

1.9.0.CR1-redhat-1

1.9.0.CR1-redhat-2

1.9.0.Final

1.9.0.Final-redhat-1

1.9.1.Final

1.9.2.Final

1.9.2.Test

1.9.3.Final

1.9.4.Final

1.9.5.Final

1.9.6.Final

1.9.7.Final

1.9.8.Final

10.*

10.0.0

10.0.1

10.0.2

11.*

11.0.0

11.0.1

11.0.2

11.0.3

12.*

12.0.0

12.0.1

12.0.2

12.0.3

12.0.4

13.*

13.0.0

13.0.1

14.*

14.0.0

15.*

15.0.0

15.0.1

15.0.2

2.*

2.0.0.CR1

2.0.0.Final

2.0.0.Test2

2.1.0.CR1

2.1.0.Final

2.2.0.CR1

2.2.0.Final

2.2.0.Test1

2.2.1.Final

2.3.0.CR1

2.3.0.Final

2.4.0.CR1

2.4.0.Final

2.4.0.Test

2.5.0.CR1

2.5.0.Final

2.5.1.Final

2.5.10.Final

2.5.2.Final

2.5.3.Final

2.5.4.Final

2.5.5.Final

2.5.6.Final

2.5.7.Final

2.5.8.Final

2.5.9.Final

3.*

3.0.0.CR1

3.0.0.Final

3.1.0.CR1

3.1.0.Final

3.1.1.Final-rhsso

3.2.0.CR1

3.2.0.Final

3.2.0.Final-rhsso

3.2.1.Final

3.3.0.CR1

3.3.0.CR2

3.3.0.Final

3.4.0.CR1

3.4.0.Final

3.4.1.CR1

3.4.1.Final

3.4.2.Final

3.4.3.Final

3.4.3.Final-2

4.*

4.0.0.Beta1

4.0.0.Beta2

4.0.0.Beta3

4.0.0.Final

4.1.0.Final

4.2.0.Final

4.2.1.Final

4.3.0.Final

4.4.0.Final

4.5.0.Final

4.6.0.Final

4.6.0.Tmp

4.7.0.Final

4.8.0.Final

4.8.1.Final

4.8.2.Final

4.8.3.Final

5.*

5.0.0

6.*

6.0.0

6.0.1

7.*

7.0.0

8.*

8.0.0

8.0.1

8.0.2

9.*

9.0.0

9.0.2

9.0.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-3632.json"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "7.4"
            },
            {
                "fixed": "7.4.9"
            }
        ]
    }
]

vanir_signatures

[
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "118702147000229535284737376204798166263",
                "322578119483772270387982475281248716305"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4",
        "id": "CVE-2021-3632-5fbb4664",
        "target": {
            "file": "services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnPasswordlessAuthenticatorFactory.java"
        }
    }
]