CVE-2016-8629
Moderate severity vulnerability that affects org.keycloak:keycloak-core
CVE-2016-8629 is a medium vulnerability (CVSS 6.5) in Keycloak, published March 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 80th percentile. Fixed in org.keycloak:keycloak-core 2.4.0.
- Severity
- 6.5 MediumCVSS 3.0, NVD
- Exploit chance
- 1.90%EPSS, 80th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.4.0org.keycloak:keycloak-core +35 more
Description
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-coreMaven | before 2.4.0 | 2.4.0 |
org.keycloak:keycloak-coreMaven | before 2.4.0, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final | 2.4.0 |
rh-sso7Red Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:1-2.jbcs.el6 | 0:1-2.jbcs.el6 |
rh-sso7-freemarkerRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:2.3.23-1.redhat_2.2.jbcs.el6 | 0:2.3.23-1.redhat_2.2.jbcs.el6 |
rh-sso7-javapackages-toolsRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.4.1-5.15.3.jbcs.el6 | 0:3.4.1-5.15.3.jbcs.el6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:2.5.5-2.Final_redhat_1.1.jbcs.el6 | 0:2.5.5-2.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:2.5.5-2.Final_redhat_1.1.jbcs.el6 | 0:2.5.5-2.Final_redhat_1.1.jbcs.el6 |
rh-sso7-libunix-dbus-javaRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:0.8.0-2.jbcs.el6 | 0:0.8.0-2.jbcs.el6 |
rh-sso7-libunix-dbus-java-debuginfoRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:0.8.0-2.jbcs.el6 | 0:0.8.0-2.jbcs.el6 |
rh-sso7-libunix-dbus-java-develRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:0.8.0-2.jbcs.el6 | 0:0.8.0-2.jbcs.el6 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-sso7-liquibaseRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.4.1-2.redhat_2.1.jbcs.el6 | 0:3.4.1-2.redhat_2.1.jbcs.el6 |
rh-sso7-liquibase-coreRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.4.1-2.redhat_2.1.jbcs.el6 | 0:3.4.1-2.redhat_2.1.jbcs.el6 |
rh-sso7-python-javapackagesRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.4.1-5.15.3.jbcs.el6 | 0:3.4.1-5.15.3.jbcs.el6 |
rh-sso7-runtimeRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:1-2.jbcs.el6 | 0:1-2.jbcs.el6 |
rh-sso7-twitter4jRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:4.0.4-1.redhat_3.1.jbcs.el6 | 0:4.0.4-1.redhat_3.1.jbcs.el6 |
rh-sso7-twitter4j-coreRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:4.0.4-1.redhat_3.1.jbcs.el6 | 0:4.0.4-1.redhat_3.1.jbcs.el6 |
rh-sso7-zxingRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.2.1-1.redhat_4.1.jbcs.el6 | 0:3.2.1-1.redhat_4.1.jbcs.el6 |
rh-sso7-zxing-coreRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.2.1-1.redhat_4.1.jbcs.el6 | 0:3.2.1-1.redhat_4.1.jbcs.el6 |
rh-sso7-zxing-javaseRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs | before 0:3.2.1-1.redhat_4.1.jbcs.el6 | 0:3.2.1-1.redhat_4.1.jbcs.el6 |
rh-sso7Red Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:1-2.jbcs.el7 | 0:1-2.jbcs.el7 |
rh-sso7-freemarkerRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:2.3.23-1.redhat_2.2.jbcs.el7 | 0:2.3.23-1.redhat_2.2.jbcs.el7 |
rh-sso7-javapackages-toolsRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.4.1-5.15.3.jbcs.el7 | 0:3.4.1-5.15.3.jbcs.el7 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:2.5.5-2.Final_redhat_1.1.jbcs.el7 | 0:2.5.5-2.Final_redhat_1.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:2.5.5-2.Final_redhat_1.1.jbcs.el7 | 0:2.5.5-2.Final_redhat_1.1.jbcs.el7 |
rh-sso7-libunix-dbus-javaRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:0.8.0-2.jbcs.el7 | 0:0.8.0-2.jbcs.el7 |
rh-sso7-libunix-dbus-java-debuginfoRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:0.8.0-2.jbcs.el7 | 0:0.8.0-2.jbcs.el7 |
rh-sso7-libunix-dbus-java-develRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:0.8.0-2.jbcs.el7 | 0:0.8.0-2.jbcs.el7 |
rh-sso7-liquibaseRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.4.1-2.redhat_2.1.jbcs.el7 | 0:3.4.1-2.redhat_2.1.jbcs.el7 |
rh-sso7-liquibase-coreRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.4.1-2.redhat_2.1.jbcs.el7 | 0:3.4.1-2.redhat_2.1.jbcs.el7 |
rh-sso7-python-javapackagesRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.4.1-5.15.3.jbcs.el7 | 0:3.4.1-5.15.3.jbcs.el7 |
rh-sso7-runtimeRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:1-2.jbcs.el7 | 0:1-2.jbcs.el7 |
rh-sso7-twitter4jRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:4.0.4-1.redhat_3.1.jbcs.el7 | 0:4.0.4-1.redhat_3.1.jbcs.el7 |
rh-sso7-twitter4j-coreRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:4.0.4-1.redhat_3.1.jbcs.el7 | 0:4.0.4-1.redhat_3.1.jbcs.el7 |
rh-sso7-zxingRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.2.1-1.redhat_4.1.jbcs.el7 | 0:3.2.1-1.redhat_4.1.jbcs.el7 |
rh-sso7-zxing-coreRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.2.1-1.redhat_4.1.jbcs.el7 | 0:3.2.1-1.redhat_4.1.jbcs.el7 |
rh-sso7-zxing-javaseRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs | before 0:3.2.1-1.redhat_4.1.jbcs.el7 | 0:3.2.1-1.redhat_4.1.jbcs.el7 |
What each source reports
NVD Score used
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
- Record
CVE-2016-8629- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:P - Weakness
- CWE-284, CWE-264
- Updated
- 2026-11-02
CVE ListNo score
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
- Record
CVE-2016-8629- Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2018-0534No score
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
- Record
EUVD-2018-0534- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-778x-2mqv-w6xwNo score
Moderate severity vulnerability that affects org.keycloak:keycloak-core
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
- Record
GHSA-778x-2mqv-w6xw- Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
- Record
CVE-2016-8629- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2017:0872
Red Hat Security Advisory: Red Hat Single Sign-On 7.1 update on RHEL 6
- Record
RHSA-2017:0872- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVRHSA-2017:0873
Red Hat Security Advisory: Red Hat Single Sign-On 7.1 update on RHEL 7
- Record
RHSA-2017:0873- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
OSVGHSA-778x-2mqv-w6xwNo score
Moderate severity vulnerability that affects org.keycloak:keycloak-core
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
- Record
GHSA-778x-2mqv-w6xw- Weakness
- CWE-284
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2017-0876.html
securitytracker.com/id/1038180
bugzilla.redhat.com/show_bug.cgi?id=1388988
securityfocus.com/bid/97392
access.redhat.com/errata/RHSA-2017:0873
Show 18 moreShow less
nvd.nist.gov/vuln/detail/CVE-2016-8629
github.com/advisories/GHSA-778x-2mqv-w6xw
issues.redhat.com/browse/RHSSO-427
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0872.json
cve.org/CVERecord?id=CVE-2016-8629
Left out here: 11 versions. The JSON record has them.