Can you explain this vulnerability to me?

This vulnerability in Keycloak allows an authenticated attacker who is merging accounts during an identity provider login to modify their email address to match a victim's email. This triggers a verification email sent to the victim without showing the attacker's email in the message, creating a phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

The vulnerability can lead to unauthorized access to user accounts by attackers through phishing. This compromises account security and can result in loss of sensitive information, unauthorized actions under the victim's identity, and potential further exploitation of the affected system.

Useful 0 Not Useful 0