Advisory Weakness Curation

Keycloak users may be able to remove MFA from other users' devices A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.

Incorrect Authorization A flaw was found in Keycloak where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

Incorrect Authorization An attacker could use the 'remove devices form' to post different credential IDs and possibly remove MFA devices for other users.