title: Plaintext storage of user password
description: A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients with proper rights and roles are able to read users attributes, allowing a malicious user with minimal access to retrieve the users passwords in clear text, jeopardizing their environment.
problem types: Plaintext Storage of a Password
affected:
{
product: keycloak
vendor: n/a
versions:
version: 22.0.3, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: keycloak
defaultStatus: unaffected
cpes: cpe:/a:redhat:red_hat_single_sign_on:7
}
metrics:
other: [
content: {'value': 'Important', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]