# Keycloak CVE-2021-4133 allows user creation through the administrative REST API

DevFeed: [Keycloak CVE-2021-4133 allows user creation through the administrative REST API](<https://devfeed.tech/articles/important-security-vulnerability-discovered-31590.md>)

Original publisher: [Read original article](<https://www.keycloak.org/2021/12/cve>)

Author: Stian Thorgersen

Published: 2021-12-23T00:00:00Z

Content type: news

Language: en

Sources: [Keycloak Blog](<https://devfeed.tech/sources/keycloak-blog.md>)

Topics: [Keycloak](<https://devfeed.tech/topics/keycloak.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [REST API](<https://devfeed.tech/topics/rest-api.md>), [upgrade](<https://devfeed.tech/topics/upgrade.md>)

Tags: [cve](<https://devfeed.tech/tags/cve.md>), [idm](<https://devfeed.tech/tags/idm.md>), [kerberos](<https://devfeed.tech/tags/kerberos.md>), [keycloak](<https://devfeed.tech/tags/keycloak.md>), [ldap](<https://devfeed.tech/tags/ldap.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [rest-api](<https://devfeed.tech/tags/rest-api.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sso](<https://devfeed.tech/tags/sso.md>), [upgrade](<https://devfeed.tech/tags/upgrade.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Keycloak disclosed CVE-2021-4133, affecting versions 12.0.0 through before 15.1.1. An attacker with an existing account can create default user accounts through the administrative REST API even when registration is disabled; some harder-to-reproduce vectors may grant additional privileges. The advisory recommends upgrading to Keycloak 15.1.1 or 16.1.0, or blocking the user-creation endpoint if upgrading is not possible.

## Source excerpt

A flaw (CVE-2021-4133) was found in Keycloak version from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the administrative REST API even when new user registration is disabled. In most situations the newly created user is the equivalent of a self-registered user, and does not have the ability to receive any additional roles or groups. However, there are some vectors that are harder to reproduce, but may result in additional privileges. We highly recommend everyone upgrade to Keycloak 15.1.1 or 16.1.0 as soon as possible. Keycloak 16.0.0 also includes the fix, but if you are not already running this version we recommend going straight to 16.1.0. If you are unable to upgrade we recommend mitigate the issue by blocking access to the user creation REST endpoint in the interim. This can be achieved with the following CLI commands: bin/jboss-cli.sh --connect /subsystem=undertow/configuration=filter/expression-filter=keycloakPathOverrideUsersCreateEndpoint:add( \ expression="(regex('^/auth/admin/realms/(.*)/users$') and method(POST))-> response-code(400)" \ ) /subsystem=undertow/server=default-server/host=default-host/filter-ref=keycloakPathOverrideUsersCreateEndpoint:add() This will block both valid and invalid attempts at creating new users, including requests from the Keycloak admin console. Alternatively, the path /auth/admin/realms/.*/users and method POST, or /auth/admin completely, can be blocked with a firewall. For more information about the flaw please view CVE-2021-4133 and GHSA-83x4-9cwr-5487.