Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-xq2v-4txb-sueu
Vulnerability ID VCID-xq2v-4txb-sueu
Aliases CVE-2023-0105
GHSA-c7xw-p58w-h6fj
Summary Keycloak: Impersonation and lockout possible through incorrect handling of email trust Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-287 Improper Authentication
CWE-841 Improper Enforcement of Behavioral Workflow
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0105.json
cvssv3.1 6.5 https://access.redhat.com/security/cve/CVE-2023-0105
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2023-0105
ssvc Track https://access.redhat.com/security/cve/CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-0105
cvssv3.1 6.5 https://bugzilla.redhat.com/show_bug.cgi?id=2158910
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2158910
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-c7xw-p58w-h6fj
cvssv3.1 6.5 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 6.5 https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
generic_textual MODERATE https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
cvssv3.1 6.5 https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
cvssv3.1_qr MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
generic_textual MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0105.json
https://access.redhat.com/security/cve/CVE-2023-0105
https://api.first.org/data/v1/epss?cve=CVE-2023-0105
https://bugzilla.redhat.com/show_bug.cgi?id=2158910
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
GHSA-c7xw-p58w-h6fj https://github.com/advisories/GHSA-c7xw-p58w-h6fj
RHSA-2023:7482 https://access.redhat.com/errata/RHSA-2023:7482
RHSA-2023:7483 https://access.redhat.com/errata/RHSA-2023:7483
RHSA-2023:7484 https://access.redhat.com/errata/RHSA-2023:7484
RHSA-2023:7486 https://access.redhat.com/errata/RHSA-2023:7486
RHSA-2023:7488 https://access.redhat.com/errata/RHSA-2023:7488
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-0105.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://access.redhat.com/security/cve/CVE-2023-0105
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-04-09T13:47:18Z/ Found at https://access.redhat.com/security/cve/CVE-2023-0105
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=2158910
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/keycloak/keycloak/commit/87a50d3ba790b049e436c9925874f9b418af7988
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-c7xw-p58w-h6fj
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.42423
EPSS Score 0.00203
Published At April 2, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:58:55.898069+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/07/GHSA-c7xw-p58w-h6fj/GHSA-c7xw-p58w-h6fj.json 38.0.0