CVE-2019-14909

Published: Dec 4, 2019Modified: Jun 17, 2026

8.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.7

Source: NVD

Description

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

Affected (2)

Products: Redhat: Keycloak

Redhat

1 product

Keycloak

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Keycloak	Version 7.0.0
Redhat Keycloak	Version 7.0.1

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-305

Authentication Bypass by Primary Weakness

The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.

CWE-592

DEPRECATED: Authentication Bypass Issues

This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.