| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-core | < 9.0.2 | 9.0.2 |
| keycloak | = 8.0.2= 9.0.0 |
A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free