← Back

CVE-2019-14837

nvd nist
Published: Jan 7, 2020Modified: Jun 17, 2026

JSON object

Loading...
9.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Exploitability: 3.9 / Impact: 5.2
Source: NVD

Description

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.

Affected (2)

Redhat
2 products
Keycloak
Single Sign On
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Keycloak
Before 8.0.0
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Single Sign On
Version 7.3

Related CWEs

CWE-547
Use of Hard-coded, Security-relevant Constants
The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
CWE-798
Use of Hard-coded Credentials
The product contains hard-coded credentials, such as a password or cryptographic key.

References (6)

Source: secalert@redhat.com
ExploitIssue TrackingVendor Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: secalert@redhat.com
Issue TrackingPermissions RequiredVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPermissions RequiredVendor Advisory

Timeline

No history available yet.