Search for vulnerabilities
Vulnerability details: VCID-8k4c-w1dp-87du
Vulnerability ID VCID-8k4c-w1dp-87du
Aliases CVE-2021-3632
GHSA-qpq9-jpv4-6gwr
Summary Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3632.json
cvssv3.1 7.5 https://access.redhat.com/security/cve/CVE-2021-3632
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=1978196
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=1978196
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qpq9-jpv4-6gwr
cvssv3.1 7.5 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 7.5 https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
generic_textual HIGH https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
cvssv3.1 7.5 https://github.com/keycloak/keycloak/pull/8203
generic_textual HIGH https://github.com/keycloak/keycloak/pull/8203
cvssv3.1 7.5 https://issues.redhat.com/browse/KEYCLOAK-18500
generic_textual HIGH https://issues.redhat.com/browse/KEYCLOAK-18500
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-3632
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-3632
archlinux High https://security.archlinux.org/AVG-1332
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3632.json
https://access.redhat.com/security/cve/CVE-2021-3632
https://api.first.org/data/v1/epss?cve=CVE-2021-3632
https://bugzilla.redhat.com/show_bug.cgi?id=1978196
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
https://github.com/keycloak/keycloak/pull/8203
https://issues.redhat.com/browse/KEYCLOAK-18500
https://nvd.nist.gov/vuln/detail/CVE-2021-3632
AVG-1332 https://security.archlinux.org/AVG-1332
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
GHSA-qpq9-jpv4-6gwr https://github.com/advisories/GHSA-qpq9-jpv4-6gwr
RHSA-2021:3527 https://access.redhat.com/errata/RHSA-2021:3527
RHSA-2021:3528 https://access.redhat.com/errata/RHSA-2021:3528
RHSA-2021:3529 https://access.redhat.com/errata/RHSA-2021:3529
RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3632.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2021-3632
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1978196
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak/pull/8203
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://issues.redhat.com/browse/KEYCLOAK-18500
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3632
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.34064
EPSS Score 0.00135
Published At Aug. 4, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:03:17.956316+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-qpq9-jpv4-6gwr/GHSA-qpq9-jpv4-6gwr.json 37.0.0