GHSA-cf8f-w2c5-p5jrCriticalCVSS 9.1

keycloak vulnerable to unauthorized login via mail server setup

Published
May 24, 2022
Last Modified
November 6, 2023

🔗 CVE IDs covered (1)

CVE-2019-14837 →

📋 Description

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'.

🎯 Affected products1

  • maven/org.keycloak:keycloak-core:< 8.0.0

🔗 References (5)