CVE-2021-4133

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
n/aKeycloakkeycloak 15.1.1

References

Timeline

Published
Jan 25, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-413307.8Microsoft Windows Media Foundation Remote Code Execution VulnerabilityCVE-2021-413317.8Windows Media Audio Decoder Remote Code Execution VulnerabilityCVE-2021-413326.5Windows Print Spooler Information Disclosure VulnerabilityCVE-2021-413337.8Windows Print Spooler Elevation of Privilege VulnerabilityCVE-2021-413347.0Windows Desktop Bridge Elevation of Privilege VulnerabilityCVE-2021-413357.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2021-413365.5Windows Kernel Information Disclosure VulnerabilityCVE-2021-413374.9Active Directory Security Feature Bypass VulnerabilityCVE-2021-413385.5Windows AppContainer Firewall Rules Security Feature Bypass VulnerabilityCVE-2021-413394.7Microsoft DWM Core Library Elevation of Privilege VulnerabilityCVE-2021-41344.9The Fancy Product Designer WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the ID paramCVE-2021-413407.8Windows Graphics Component Remote Code Execution Vulnerability
CVE-2021-4133: High severity, CVSS 8.8 | Vulnix