Search for vulnerabilities
Vulnerability details: VCID-khbc-26kj-aaad
Vulnerability ID VCID-khbc-26kj-aaad
Aliases CVE-2021-3632
GHSA-qpq9-jpv4-6gwr
Summary CVE-2021-3632 keycloak: Anyone can register a new device when there is no device registered for passwordless login
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-287 Improper Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3527
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3528
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3529
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3534
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3632.json
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00111 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00126 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00135 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00211 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00254 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
epss 0.00457 https://api.first.org/data/v1/epss?cve=CVE-2021-3632
cvssv3.1 7.5 https://bugzilla.redhat.com/show_bug.cgi?id=1978196
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=1978196
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-qpq9-jpv4-6gwr
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qpq9-jpv4-6gwr
cvssv3.1 6.8 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 7.5 https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
generic_textual HIGH https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
cvssv3.1 7.5 https://github.com/keycloak/keycloak/pull/8203
generic_textual HIGH https://github.com/keycloak/keycloak/pull/8203
cvssv3.1 7.5 https://issues.redhat.com/browse/KEYCLOAK-18500
generic_textual HIGH https://issues.redhat.com/browse/KEYCLOAK-18500
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-3632
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-3632
archlinux High https://security.archlinux.org/AVG-1332
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3632.json
https://api.first.org/data/v1/epss?cve=CVE-2021-3632
https://bugzilla.redhat.com/show_bug.cgi?id=1978196
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
https://github.com/keycloak/keycloak/pull/8203
https://issues.redhat.com/browse/KEYCLOAK-18500
AVG-1332 https://security.archlinux.org/AVG-1332
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:single_sign-on:7.0:*:*:*:*:*:*:*
CVE-2021-3632 https://access.redhat.com/security/cve/CVE-2021-3632
CVE-2021-3632 https://nvd.nist.gov/vuln/detail/CVE-2021-3632
GHSA-qpq9-jpv4-6gwr https://github.com/advisories/GHSA-qpq9-jpv4-6gwr
RHSA-2021:3527 https://access.redhat.com/errata/RHSA-2021:3527
RHSA-2021:3528 https://access.redhat.com/errata/RHSA-2021:3528
RHSA-2021:3529 https://access.redhat.com/errata/RHSA-2021:3529
RHSA-2021:3534 https://access.redhat.com/errata/RHSA-2021:3534
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3632.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1978196
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak/commit/65480cb5a11630909c086f79d396004499fbd1e4
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak/pull/8203
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://issues.redhat.com/browse/KEYCLOAK-18500
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3632
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-3632
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.26496
EPSS Score 0.00111
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.