CVE-2023-0105

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
redhat.com	Keycloak	—

References

https://access.redhat.com/security/cve/CVE-2023-0105Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-0105Vendor Advisory

Timeline

Published: Jan 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-01065.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01075.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01085.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01095.4A stored cross-site scripting (XSS) vulnerability was discovered in usememos/memos version 0.9.1. This vulnerability allows an attacker to u CVE-2023-01105.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01115.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01125.4Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.CVE-2023-01137.5A vulnerability was found in Netis Netcore Router up to 2.2.6. It has been declared as problematic. Affected by this vulnerability is an unk CVE-2023-01145.5A vulnerability was found in Netis Netcore Router. It has been rated as problematic. Affected by this issue is some unknown functionality of CVE-2023-01167.5The reminder module lacks an authentication mechanism for broadcasts received. Successful exploitation of this vulnerability may affect avai CVE-2023-01175.3The online authentication provided by the hwKitAssistant lacks strict identity verification of applications. Successful exploitation of this CVE-2023-01189.1An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary