CVE-2021-4133: 
Java vulnerability analysis and mitigation

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled (NVD, GitHub Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is categorized as CWE-863 (Incorrect Authorization) and affects the keycloak-services Java package (NVD).

This vulnerability allows an attacker with any existing user account to bypass authorization controls and create new default user accounts through the administrative REST API, even when new user registration functionality is disabled. This could lead to unauthorized account creation and potential system compromise (Red Hat Bugzilla).

The vulnerability requires an attacker to have an existing user account in the system. The attack can be executed remotely through the administrative REST API with low attack complexity (NVD).

The vulnerability has been fixed in Keycloak version 15.1.1 and version 16.0.0. Users should upgrade to these or later versions to address the security issue. Red Hat has also released security updates for affected products including Red Hat Single Sign-On (Red Hat Advisory).