CVE-2021-3754

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in case the user forgets the password.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	keycloak	Not-Known

References

https://access.redhat.com/security/cve/CVE-2021-3754Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1999196Issue Tracking, Vendor Advisory
https://access.redhat.com/security/cve/CVE-2021-3754Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1999196Issue Tracking, Vendor Advisory

Timeline

Published: Aug 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-375406.5In JetBrains Hub before 2021.1.13262, a potentially insufficient CSP for the Widget deployment feature was used.CVE-2021-375416.1In JetBrains Hub before 2021.1.13402, HTML injection in the password reset email was possible.CVE-2021-375426.1In JetBrains TeamCity before 2020.2.3, XSS was possible.CVE-2021-375438.8In JetBrains RubyMine before 2021.1.1, code execution without user confirmation was possible for untrusted projects.CVE-2021-375449.8In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.CVE-2021-375457.5In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.CVE-2021-375465.3In JetBrains TeamCity before 2021.1, an insecure key generation mechanism for encrypted properties was used.CVE-2021-375475.3In JetBrains TeamCity before 2020.2.4, insufficient checks during file uploading were made.CVE-2021-375487.5In JetBrains TeamCity before 2021.1, passwords in cleartext sometimes could be stored in VCS.CVE-2021-375499.1In JetBrains YouTrack before 2021.1.11111, sandboxing in workflows was insufficient.CVE-2021-375507.5In JetBrains YouTrack before 2021.2.16363, time-unsafe comparisons were used.CVE-2021-375515.3In JetBrains YouTrack before 2021.2.16363, system user passwords were hashed with SHA-256.