CVSS 3.1
4.2 mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:NCVE-2020-27826
Medium (4.2) in redhat. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in org.keycloak:keycloak-core 12.0.0.
A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-250
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:keycloak
- redhat:single_sign-on
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-m9cj-v55f-8x26 | Maven | org.keycloak:keycloak-core | <12.0.0 | 12.0.0 |