CVE-2021-3632: Red Hat Keycloak

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow.

Affected products

• Red Hat Keycloak: before 15.1.0 (fixed in 15.1.0)
• Red Hat Single Sign-On: version 7.0 only; from 7.4, before 7.4.9 (fixed in 7.4.9)

Published 2022-08-26. Last modified 2026-06-17.