CVE-2020-10686: medium-severity vulnerability in keycloak
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.1epss 0.7%
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
Keycloak · keycloakRelated CVEs — keycloak
In the same product, most dangerous first.
CVE-2025-8419MEDIUMOrg.keycloak/keycloak-services: keycloak smtp inject vulnerabilityEPSS 0.6%CVE-2025-9162MEDIUMOrg.keycloak/keycloak-model-storage-service: variable injection into environment variablesEPSS 0.5%CVE-2025-11538MEDIUMKeycloak-server: debug default bind addressEPSS 0.4%CVE-2025-10939LOWOrg.keycloak/keycloak-quarkus-server: unable to restrict access to the admin consoleEPSS 0.4%CVE-2025-10044MEDIUMKeycloak: keycloak error_description injection on error pagesEPSS 0.3%CVE-2025-12110MEDIUMKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removedEPSS 0.3%