CVE-2021-4133
Improper Authorization in Keycloak
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
- Record
CVE-2021-4133- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
- Record
CVE-2021-4133- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2022-0514 No score
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
- Record
EUVD-2022-0514- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-83x4-9cwr-5487
Improper Authorization in Keycloak
A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
- Record
GHSA-83x4-9cwr-5487- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.
- Record
CVE-2021-4133- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-83x4-9cwr-5487
Improper Authorization in Keycloak
A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
- Record
GHSA-83x4-9cwr-5487- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-863
- Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2021:5218
Red Hat Security Advisory: Red Hat Single Sign-On 7.5.0 security update on RHEL 7
- Record
RHSA-2021:5218- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2021:5219
Red Hat Security Advisory: Red Hat Single Sign-On security update on RHEL 8
- Record
RHSA-2021:5219- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0151
Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 7
- Record
RHSA-2022:0151- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2022:0152
Red Hat Security Advisory: Red Hat Single Sign-On 7.5.1 security update on RHEL 8
- Record
RHSA-2022:0152- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 15.1.1 | 15.1.1 |
org.keycloak:keycloak-servicesMaven |
before 15.1.1, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
15.1.1 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.5::el7 |
before 0:15.0.2-3.redhat_00002.1.el7sso | 0:15.0.2-3.redhat_00002.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.5::el7 |
before 0:15.0.2-3.redhat_00002.1.el7sso | 0:15.0.2-3.redhat_00002.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.5::el8 |
before 0:15.0.2-3.redhat_00002.1.el8sso | 0:15.0.2-3.redhat_00002.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.5::el8 |
before 0:15.0.2-3.redhat_00002.1.el8sso | 0:15.0.2-3.redhat_00002.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.5::el7 From an advisory covering 4 CVEs |
before 0:15.0.4-1.redhat_00001.1.el7sso | 0:15.0.4-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.5::el7 From an advisory covering 4 CVEs |
before 0:15.0.4-1.redhat_00001.1.el7sso | 0:15.0.4-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.5::el8 From an advisory covering 4 CVEs |
before 0:15.0.4-1.redhat_00001.1.el8sso | 0:15.0.4-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.5::el8 From an advisory covering 4 CVEs |
before 0:15.0.4-1.redhat_00001.1.el8sso | 0:15.0.4-1.redhat_00001.1.el8sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4133 is a high vulnerability (CVSS 8.8) in Keycloak, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.37%, the 72nd percentile. Fixed in org.keycloak:keycloak-services 15.1.1.
References
bugzilla.redhat.com/show_bug.cgi?id=2033602
github.com/keycloak/keycloak/issues/9247
oracle.com/security-alerts/cpuapr2022.html
nvd.nist.gov/vuln/detail/CVE-2021-4133
Show 29 moreShow less
access.redhat.com/errata/RHSA-2021:5218
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5218.json
cve.org/CVERecord?id=CVE-2021-4133
issues.redhat.com/browse/CIAM-1616
lists.apache.org/thread.html/r8848751b6a5dd78cc9e99d627e74fecfaffdfa1bb615dce827aad633%40%3Cdev.santuario.apache.org%3E
Left out here: 79 versions. The JSON record has them.