{"id":"CVE-2021-3754","aliases":["EUVD-2024-1917","GHSA-4vc8-pg5c-vg4x"],"status":"published","title":"Keycloak's improper input validation allows using email as username","description":"A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02194,"percentile":0.82595,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20","CWE-670"],"published":"2022-08-26T15:25:40Z","modified":"2026-10-24T10:30:28Z","exploits":[{"source":"pocgithub","id":"7Ragnarok7/CVE-2021-3754","title":"7Ragnarok7/CVE-2021-3754","date":"2023-09-07","url":"https://github.com/7Ragnarok7/CVE-2021-3754"}],"fixes":[{"ecosystem":"Maven","package":"org.keycloak:keycloak-services","fixed_in":["24.0.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.keycloak:keycloak-services","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0.1"}]}],"versions":["1.0-alpha-1","1.0-alpha-1-12062013","1.0-alpha-2","1.0-alpha-3","1.0-alpha-4","1.0-beta-1","1.0-beta-1-20150521","1.0-beta-1-20150523","1.0-beta-2","1.0-beta-3","1.0-beta-4","1.0-final","1.0-rc-1","1.0-rc-2","1.0.1.Final","1.0.2.Final","1.0.3.Final","1.0.4.Final","1.0.5.Final","1.1.0.Beta1","1.1.0.Beta2","1.1.0.Final","1.1.1.Final","1.2.0.Beta1","1.2.0.CR1","1.2.0.Final","1.3.0.Final","1.3.1.Final","1.4.0.Final","1.5.0-Final","1.5.0.Final","1.5.1.Final","1.6.0.Final","1.6.1.Final","1.7.0.CR1","1.7.0.Final","1.8.0.Alpha1","1.8.0.CR1","1.8.0.CR2","1.8.0.CR3","1.8.0.Final","1.8.1.Final","1.9.0.CR1","1.9.0.Final","1.9.1.Final","1.9.2.Final","1.9.3.Final","1.9.4.Final","1.9.5.Final","1.9.7.Final","1.9.8.Final","10.0.0","10.0.1","10.0.2","11.0.0","11.0.1","11.0.2","11.0.3","12.0.0","12.0.1","12.0.2","12.0.3","12.0.4","13.0.0","13.0.1","14.0.0","15.0.0","15.0.1","15.0.2","15.1.0","15.1.1","16.0.0","16.1.0","16.1.1","17.0.0","17.0.1","18.0.0","18.0.1","18.0.2","19.0.0","19.0.1","19.0.2","19.0.3","2.0.0.CR1","2.0.0.Final","2.1.0.CR1","2.1.0.Final","2.2.0.CR1","2.2.0.Final","2.2.1.Final","2.3.0.CR1","2.3.0.Final","2.4.0.CR1","2.4.0.Final","2.5.0.CR1","2.5.0.Final","2.5.1.Final","2.5.4.Final","2.5.5.Final","20.0.0","20.0.1","20.0.2","20.0.3","20.0.4","20.0.5","21.0.0","21.0.1","21.0.2","21.1.0","21.1.1","21.1.2","22.0.0","22.0.1","22.0.2","22.0.3","22.0.4","22.0.5","23.0.0","23.0.1","23.0.2","23.0.3","23.0.4","23.0.5","23.0.6","23.0.7","24.0.0","3.0.0.CR1","3.0.0.Final","3.1.0.CR1","3.1.0.Final","3.2.0.CR1","3.2.0.Final","3.2.1.Final","3.3.0.CR1","3.3.0.CR2","3.3.0.Final","3.4.0.CR1","3.4.0.Final","3.4.1.CR1","3.4.1.Final","3.4.2.Final","3.4.3.Final","4.0.0.Beta1","4.0.0.Beta2","4.0.0.Beta3","4.0.0.Final","4.1.0.Final","4.2.0.Final","4.2.1.Final","4.3.0.Final","4.4.0.Final","4.5.0.Final","4.6.0.Final","4.7.0.Final","4.8.0.Final","4.8.1.Final","4.8.2.Final","4.8.3.Final","5.0.0","6.0.0","6.0.1","7.0.0","7.0.1","8.0.0","8.0.1","8.0.2","9.0.0","9.0.2","9.0.3"]}],"products":[{"vendor":"keycloak","product":"keycloak"},{"vendor":"redhat","product":"keycloak"},{"vendor":"redhat","product":"single_sign-on"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1999196","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-3754","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/keycloak/keycloak/security/advisories/GHSA-4vc8-pg5c-vg4x","tags":["web"]},{"url":"https://github.com/keycloak/keycloak/commit/f9708037383aa98741e4850447de64dc4a0d4b4e","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3754","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4vc8-pg5c-vg4x"},{"url":"https://github.com/keycloak/keycloak","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-3754","description":"A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.","status":"published","published":"2022-08-26T15:25:40Z","modified":"2024-08-03T17:09:08.286Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2024-1917","description":"A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.","status":"published","published":"2022-08-26T15:25:40Z","modified":"2024-08-03T17:09:08Z","updated_at":"2026-11-03T03:25:11.953192Z"}],"ghsa":[{"id":"GHSA-4vc8-pg5c-vg4x","title":"Keycloak's improper input validation allows using email as username","description":"Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.","status":"published","published":"2024-06-12T19:41:05Z","modified":"2024-12-20T17:49:11Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T14:38:25.334027Z"}],"nvd":[{"id":"CVE-2021-3754","description":"A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.","status":"published","published":"2022-08-26T16:15:09.52Z","modified":"2026-06-17T04:05:42.23Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:07:06.906968Z"}],"osv":[{"id":"CVE-2021-3754","description":"A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.","status":"published","published":"2022-08-26T16:15:09.52Z","modified":"2026-10-24T10:30:28.976438927Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-4vc8-pg5c-vg4x","title":"Keycloak's improper input validation allows using email as username","description":"Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.","status":"published","published":"2024-06-12T19:41:05Z","modified":"2024-12-20T18:26:47.874361Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-670"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}