Description
A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
Remediation
References
https://bugzilla.redhat.com/show_bug.cgi?id=1905089
Related Vulnerabilities
CVE-2023-25157 Vulnerability in maven package org.geoserver.community:gs-jdbcconfig
CVE-2023-30846 Vulnerability in npm package typed-rest-client
CVE-2022-24785 Vulnerability in maven package org.fujion.webjars:moment
CVE-2017-16006 Vulnerability in maven package org.webjars:remarkable
CVE-2020-6950 Vulnerability in maven package org.glassfish:jakarta.faces