Description
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
References (2)
Core 2
Core References
Issue Tracking, Vendor Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1953439
Vendor Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-3513
Scores
CVSS v3
7.5
EPSS
0.0020
EPSS Percentile
41.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-522
CWE-209
Status
published
Products (2)
org.keycloak/keycloak-parent
0 - 13.0.0Maven
redhat/keycloak
< 13.0.0
Published
Aug 22, 2022
Tracked Since
Feb 18, 2026