Staging Environment: Content and features may be unstable or change without notice.

Advisory Weakness Curation

CVE-2019-14837

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-cf8f-w2c5-p5jr

keycloak vulnerable to unauthorized login via mail server setup A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.

gitlab/maven/org.keycloak/keycloak-core/CVE-2019-14837

Use of Hard-coded Credentials A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.