CVE-2020-27826

    Dashboard / Vulnerabilities / CVE-2020-27826

    CVE-2020-27826

    Published: 28 May 2021Last Modified: 7 Aug 2026

    Summary:

    Details: A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

    References: https://bugzilla.redhat.com/show_bug.cgi?id=1905089

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -2690229863ddbcdfa2c75e00a7a9858e2e03c6c9

    Affected versions

    2.4.0.Test

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-27826 | CVE-DB