Search for vulnerabilities
Vulnerability details: VCID-mvec-u55b-kbcx
Vulnerability ID VCID-mvec-u55b-kbcx
Aliases CVE-2021-4133
GHSA-83x4-9cwr-5487
Summary Improper Authorization in Keycloak A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-863 Incorrect Authorization
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 8.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4133.json
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
epss 0.00134 https://api.first.org/data/v1/epss?cve=CVE-2021-4133
cvssv3.1 8.8 https://bugzilla.redhat.com/show_bug.cgi?id=2033602
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=2033602
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-83x4-9cwr-5487
cvssv3.1 8.8 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 8.8 https://github.com/keycloak/keycloak/issues/9247
generic_textual HIGH https://github.com/keycloak/keycloak/issues/9247
cvssv3.1 8.8 https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
cvssv3.1_qr HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
generic_textual HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
cvssv2 6.5 https://nvd.nist.gov/vuln/detail/CVE-2021-4133
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2021-4133
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-4133
cvssv3.1 8.8 https://www.oracle.com/security-alerts/cpuapr2022.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpuapr2022.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4133.json
https://api.first.org/data/v1/epss?cve=CVE-2021-4133
https://bugzilla.redhat.com/show_bug.cgi?id=2033602
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/issues/9247
https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
https://nvd.nist.gov/vuln/detail/CVE-2021-4133
https://www.oracle.com/security-alerts/cpuapr2022.html
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
GHSA-83x4-9cwr-5487 https://github.com/advisories/GHSA-83x4-9cwr-5487
RHSA-2021:5217 https://access.redhat.com/errata/RHSA-2021:5217
RHSA-2021:5218 https://access.redhat.com/errata/RHSA-2021:5218
RHSA-2021:5219 https://access.redhat.com/errata/RHSA-2021:5219
RHSA-2022:0015 https://access.redhat.com/errata/RHSA-2022:0015
RHSA-2022:0034 https://access.redhat.com/errata/RHSA-2022:0034
RHSA-2022:0151 https://access.redhat.com/errata/RHSA-2022:0151
RHSA-2022:0152 https://access.redhat.com/errata/RHSA-2022:0152
RHSA-2022:0155 https://access.redhat.com/errata/RHSA-2022:0155
RHSA-2022:0164 https://access.redhat.com/errata/RHSA-2022:0164
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4133.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2033602
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak/issues/9247
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-83x4-9cwr-5487
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-4133
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-4133
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.oracle.com/security-alerts/cpuapr2022.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.3392
EPSS Score 0.00134
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:01:00.094850+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/01/GHSA-83x4-9cwr-5487/GHSA-83x4-9cwr-5487.json 37.0.0