CVE-2020-1718
Improper Authentication for Keycloak
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
- Record
CVE-2020-1718- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2022-1060
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
- Record
EUVD-2022-1060- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j229-2h63-rvh9
Improper Authentication for Keycloak
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
- Record
GHSA-j229-2h63-rvh9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
- Record
CVE-2020-1718- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
- Record
CVE-2020-1718- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-j229-2h63-rvh9
Improper Authentication for Keycloak
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
- Record
GHSA-j229-2h63-rvh9- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVRHSA-2020:2106
Red Hat Security Advisory: Red Hat Single Sign-On 7.3.8 security update on RHEL 6
- Record
RHSA-2020:2106- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2107
Red Hat Security Advisory: Red Hat Single Sign-On 7.3.8 security update on RHEL 7
- Record
RHSA-2020:2107- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2020:2108
Red Hat Security Advisory: Red Hat Single Sign-On 7.3.8 security update on RHEL 8
- Record
RHSA-2020:2108- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-parentMaven |
before 8.0.0 | 8.0.0 |
org.keycloak:keycloak-parentMaven |
before 8.0.0, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
8.0.0 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs |
before 0:4.8.20-1.Final_redhat_00001.1.el6sso | 0:4.8.20-1.Final_redhat_00001.1.el6sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 3 CVEs |
before 0:4.8.20-1.Final_redhat_00001.1.el6sso | 0:4.8.20-1.Final_redhat_00001.1.el6sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs |
before 0:4.8.20-1.Final_redhat_00001.1.el7sso | 0:4.8.20-1.Final_redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 3 CVEs |
before 0:4.8.20-1.Final_redhat_00001.1.el7sso | 0:4.8.20-1.Final_redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el8 From an advisory covering 3 CVEs |
before 0:4.8.20-1.Final_redhat_00001.1.el8sso | 0:4.8.20-1.Final_redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el8 From an advisory covering 3 CVEs |
before 0:4.8.20-1.Final_redhat_00001.1.el8sso | 0:4.8.20-1.Final_redhat_00001.1.el8sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1718 is a high vulnerability (CVSS 7.1) in Keycloak, published May 12, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in org.keycloak:keycloak-parent 8.0.0.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1718
nvd.nist.gov/vuln/detail/CVE-2020-1718
github.com/advisories/GHSA-j229-2h63-rvh9
access.redhat.com/errata/RHSA-2020:2106
Show 20 moreShow less
issues.redhat.com/browse/KEYCLOAK-13797
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2106.json
cve.org/CVERecord?id=CVE-2020-1718
Left out here: 54 versions. The JSON record has them.