CVE-2019-14837: Critical severity red hat keycloak vulnerability
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test'
Upstream issue:
https://issues.jboss.org/browse/KEYCLOAK-10780
Upstream patch:
https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f
Other sources
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
A flaw was found in Keycloak. The use of an open hard-coded domain can allow an unauthorized login by setting up a mail server and resetting the user credentials, enabling information disclosure.
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-14837?
CVE-2019-14837 is rated as a high severity vulnerability due to the potential for password reset exploitation.
How do I fix CVE-2019-14837?
To remediate CVE-2019-14837, upgrade to Keycloak version 8.0.0 or later, or update to the patched versions provided by Red Hat.
Which versions of Keycloak are affected by CVE-2019-14837?
CVE-2019-14837 affects Keycloak versions prior to 8.0.0, including specific Red Hat distributions before version 4.8.15-1.
What kind of attack does CVE-2019-14837 allow?
CVE-2019-14837 allows an attacker with knowledge of a client name to reset passwords and gain unauthorized access to accounts.
Is there a known workaround for CVE-2019-14837?
There are no known workarounds for CVE-2019-14837, so updating to a secure version is necessary.