Plaintext storage of user password

CVE-2023-4918

Summary

A vulnerability exists in the Keycloak package, specifically within the user profile module, allowing user passwords to be exposed. During the registration process, the 'password' and 'password-confirm' fields are treated as standard user attributes. This flaw permits all users and clients with the appropriate roles to access this sensitive information, enabling unauthorized users to view passwords in clear text and undermining the security of the affected environment.

References