CVE-2017-12161

CVE-2017-12161 is a high-severity vulnerability affecting Keycloak versions prior to 3.4.2 Final, allowing an attacker to spoof a URL in a password reset request by manipulating a client-side /etc/hosts entry. This flaw enables the attacker to obtain a valid password reset token, potentially leading to information disclosure or further system compromise. The vulnerability has a CVSS v3 score of 8.8 (High), indicating a network-based attack with low complexity, requiring user interaction, and resulting in high impact to confidentiality, integrity, and availability. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.