A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
References:MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJ2ZmMtZzhqNS05Y2Nm
Generation of Error Message Containing Sensitive Information in Keycloak
| Affected Packages | Affected Versions | Fixed Versions | |
|---|---|---|---|
| maven:org.keycloak:keycloak-parent | <= 7.0.1 | No known fixed version | |
Affected Version RangesAll affected versions5.0.0, 6.0.0, 6.0.1, 7.0.0, 7.0.1 |
|||