Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

Improper Authorization in KeycloakGHSA-83x4-9cwr-5487

HIGH

GHSA-83x4-9cwr-5487 is a high-severity (CVSS 8.8) CWE-863 vulnerability in org.keycloak:keycloak-services. A fix is available for org.keycloak:keycloak-services — see the affected versions and patch details below.

Also known asCVE-2021-4133
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Oct 12, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
1.4%probability of exploitation in next 30 days
Lower Risk+0.95%
Lower risk than most CVEs71th percentile — riskier than 71% of all scored CVEsHighest risk
0.00%0.62%1.25%1.87%0.4%0.4%1.4%Apr 26May 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

GHSA-83x4-9cwr-5487 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

1 pkg affected
☕org.keycloak:keycloak-services

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.keycloak:keycloak-servicesall versions15.1.1org.keycloak:keycloak-services:15.1.1

Affected Products

1 product · 1 configurations
Application
keycloakredhat
≥ 12.0.0 && < 15.1.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.keycloak:keycloak-services, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.keycloak:keycloak-services to 15.1.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-83x4-9cwr-5487 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

This flaw affects only Red Hat Single Sign-on 7.5.0. Red Hat Single Sign-on 7.4.x releases are NOT affected. Fix is available for download from customer portal which can be applied on RH-SSO 7.5.0

Workaround published by Red Hat
Access to the user-creation functionality in the REST endpoint can be deactivated using CLI commands in undertow. run: bin/jboss-cli.sh --connect /subsystem=undertow/configuration=filter/expression-filter=keycloakPathOverrideUsersCreateEndpoint:add( \ expression="(regex('^/auth/admin/realms/(.*)/users$') and method(POST))-> response-code(400)" \ ) /subsystem=undertow/server=default-server/host=default-host/filter-ref=keycloakPathOverrideUsersCreateEndpoint:add()
Source: Red Hat security advisory for GHSA-83x4-9cwr-5487 (CC BY 4.0)
ProductFixed inAdvisory
Red Hat Single Sign-On 7.5 for RHEL 7rh-sso7-keycloak-0:15.0.2-3.redhat_00002.1.el7ssoRHSA-2021:5218
Red Hat Single Sign-On 7.5 for RHEL 7rh-sso7-keycloak-0:15.0.4-1.redhat_00001.1.el7ssoRHSA-2022:0151
Red Hat Single Sign-On 7.5 for RHEL 8rh-sso7-keycloak-0:15.0.2-3.redhat_00002.1.el8ssoRHSA-2021:5219
Red Hat Single Sign-On 7.5 for RHEL 8rh-sso7-keycloak-0:15.0.4-1.redhat_00001.1.el8ssoRHSA-2022:0152
RHEL-8 based Middleware Containersrh-sso-7/sso75-openshift-rhel8:7.5-11RHSA-2022:0015
RHEL-8 based Middleware Containersrh-sso-7/sso7-rhel8-operator-bundle:7.5.0-12RHSA-2022:0034
RHEL-8 based Middleware Containersrh-sso-7/sso75-openshift-rhel8:7.5-15RHSA-2022:0164
RHSSO 7.5.1keycloak-servicesRHSA-2022:0155

Frequently Asked Questions

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
O3 Security · Impact-Aware SCA

Is GHSA-83x4-9cwr-5487 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
Improper Authorization in Keycloak (High 8.8)