CVE-2026-3429

Katalog CVE

CVSS 4.2 · Medium EPSS 0,33%

Kerentanan Improper Access Control pada redhat build of keycloak. Skor CVSS 3.1 4.2 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

Rincian

Terbit di NVD

11 Maret 2026

Terakhir diubah

18 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

4.2 (Medium), sumber redhat.com
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/errata/RHSA-2026:6477 advisory vendor
• https://access.redhat.com/errata/RHSA-2026:6478 advisory vendor
• https://access.redhat.com/security/cve/CVE-2026-3429 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2443771 issue tracking · advisory vendor