A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.

A flaw was found in the Keycloak package, more specifically org.keyclo ...

Keycloak vulnerable to Plaintext Storage of User Password

Уязвимость компонента org.keycloak.userprofile программного средства для управления идентификацией и доступом Keycloak, позволяющая нарушителю получить доступ к учетным данным пользователей