← Vulnerability feed

Vulnerability record · CVE-2023-4918 · published 12 September 2023

CVE-2023-4918: Redhat keycloak cleartext transmission vulnerability

Redhat · Keycloak

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.

8.8 CVSS 3.1 High EPSS 0.57% · top 54.8% CWE-256 · CWE-256CWE-319 · Cleartext transmission
8.8CVSS 3.1 base score
0.57%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://access.redhat.com/security/cve/CVE-2023-4918 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238588 Issue TrackingVendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-5q66-v53q-pm35 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4918 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2238588 Issue TrackingVendor Advisory
https://github.com/keycloak/keycloak/security/advisories/GHSA-5q66-v53q-pm35 Vendor Advisory

Track CVE-2023-4918 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-1245Redhat keycloak missing authorization vulnerabilityA privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid ac…EPSS 1.4%9.8CVE-2019-14910Redhat keycloak improper authentication vulnerabilityA vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDA…EPSS 1.1%9.6CVE-2021-20195Redhat keycloak improper input validation vulnerabilityA flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to …EPSS 1.2%9.1CVE-2022-3782Redhat keycloak path traversal vulnerabilitykeycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An a…EPSS 5.8%9.1CVE-2019-14837Redhat keycloak hard-coded credentials vulnerabilityA flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name …EPSS 1.7%8.8CVE-2026-3047Redhat build of keycloak vulnerabilityA flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider …EPSS 0.86%8.8CVE-2023-6787Redhat build of keycloak improper authentication vulnerabilityA flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijack…EPSS 0.74%8.8CVE-2021-4133Redhat keycloak incorrect authorization vulnerabilityA flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default …EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2023-4918), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.