How severe is CVE-2021-3424?

CVE-2021-3424 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2021-3424 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-3424?

CVE-2021-3424 affects Redhat Single Sign-on. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2021-3424?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-3424 published?

CVE-2021-3424 was published on 2021-06-01 and last updated on 2026-06-17.

CVE-2021-3424

CVE-2021-3424 is a medium-severity vulnerability in Redhat Single Sign-on with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-287.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-287
Affected product: Redhat Single Sign-on
Published: 2021-06-01
Last modified: 2026-06-17

Description

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.

Frequently asked questions

What is CVE-2021-3424?: A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
How severe is CVE-2021-3424?: CVE-2021-3424 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2021-3424 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-3424?: CVE-2021-3424 affects Redhat Single Sign-on. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2021-3424?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-3424 published?: CVE-2021-3424 was published on 2021-06-01 and last updated on 2026-06-17.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1933320

Affected products (1)

cpe:2.3:a:redhat:single_sign-on:7.4:*:*:*:*:*:*:*

More vulnerabilities in Redhat Single Sign-on

CVE-2022-4361 — Critical (CVSS 10.0): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the…
CVE-2019-10212 — Critical (CVSS 9.8): A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an…
CVE-2019-14379 — Critical (CVSS 9.8): SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used…
CVE-2025-12543 — Critical (CVSS 9.6): A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.…
CVE-2019-14887 — Critical (CVSS 9.1): A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly…
CVE-2019-14837 — Critical (CVSS 9.1): A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this…

All CVEs affecting Redhat Single Sign-on →

Other CWE-287 (Improper Authentication) vulnerabilities

CVE-2026-45480 — Critical (CVSS 10.0): Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-46389 — Critical (CVSS 10.0): UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS…
CVE-2026-10611 — Critical (CVSS 10.0): An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement.…
CVE-2026-47280 — Critical (CVSS 10.0): Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a…
CVE-2026-42822 — Critical (CVSS 10.0): Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges…
CVE-2026-20182 — Critical (CVSS 10.0): May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and…

Browse all CWE-287 (Improper Authentication) vulnerabilities →