CVE-2020-27838: Medium severity redhat keycloak vulnerability
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
Other sources
Client registration endpoints should not allow fetching information about public clients without authentication. https://issues.redhat.com/browse/KEYCLOAK-16521
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-27838?
CVE-2020-27838 is a vulnerability in Keycloak prior to version 13.0.0 that allows fetching information about PUBLIC clients without authentication.
How does CVE-2020-27838 affect Keycloak?
CVE-2020-27838 allows PUBLIC clients to access client secret information without authentication, which could be a problem if the same PUBLIC client is changed to CONFIDENTIAL later.
What is the severity of CVE-2020-27838?
CVE-2020-27838 has a severity rating of medium.
How can I fix CVE-2020-27838?
To fix CVE-2020-27838, update Keycloak to version 13.0.0 or later.
Where can I find more information about CVE-2020-27838?
You can find more information about CVE-2020-27838 at the following references: [reference 1](https://issues.redhat.com/browse/KEYCLOAK-16521) and [reference 2](https://bugzilla.redhat.com/show_bug.cgi?id=1906797).