High severity8.8NVD Advisory· Published Sep 12, 2023· Updated Jun 17, 2026
CVE-2023-4918
CVE-2023-4918
Description
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-coreMaven | >= 22.0.2, < 22.0.3 | 22.0.3 |
Affected products
3Patches
Vulnerability mechanics
References
5- access.redhat.com/security/cve/CVE-2023-4918nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-5q66-v53q-pm35ghsaADVISORY
- github.com/keycloak/keycloak/security/advisories/GHSA-5q66-v53q-pm35nvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-4918ghsaADVISORY
News mentions
0No linked articles in our index yet.