CVE-2020-1744
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
- Record
CVE-2020-1744- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-755
- Updated
- 2026-11-02
EUVDEUVD-2021-1973
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
- Record
EUVD-2021-1973- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4gf2-xv97-63m2
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
- Record
GHSA-4gf2-xv97-63m2- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-200, CWE-755
- Updated
- 2026-11-02
NVD
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
- Record
CVE-2020-1744- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-755
- Updated
- 2026-11-02
OSVGHSA-4gf2-xv97-63m2
Exposure of Sensitive Information in keycloak
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
- Record
GHSA-4gf2-xv97-63m2- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-200, CWE-755
- Updated
- 2026-11-02
OSVRHSA-2020:0945
Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 6
- Record
RHSA-2020:0945- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Show 9 moreShow less
OSVRHSA-2020:0946
Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 7
- Record
RHSA-2020:0946- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2020:0947
Red Hat Security Advisory: Red Hat Single Sign-On 7.3.7 security update on RHEL 8
- Record
RHSA-2020:0947- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10615-1 No score
ansible-2.9.24-1.2 on GA media
These are all security issues fixed in the ansible-2.9.24-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10615-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14244-1 No score
ansible-9-9.8.0-1.1 on GA media
These are all security issues fixed in the ansible-9-9.8.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14244-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14536-1 No score
ansible-10-10.6.0-1.1 on GA media
These are all security issues fixed in the ansible-10-10.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14536-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15605-1 No score
ansible-11-11.11.0-1.1 on GA media
These are all security issues fixed in the ansible-11-11.11.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15605-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15753-1 No score
ansible-12-12.2.0-1.1 on GA media
These are all security issues fixed in the ansible-12-12.2.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15753-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10944-1 No score
ansible-13-13.7.0-1.1 on GA media
These are all security issues fixed in the ansible-13-13.7.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10944-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12447-1 No score
ansible-14-14.6.0-1.1 on GA media
These are all security issues fixed in the ansible-14-14.6.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12447-1- Updated
- 2026-11-07
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-coreMaven |
before 9.0.1 | 9.0.1 |
org.keycloak:keycloak-coreMaven |
before 9.0.1, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
9.0.1 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 |
before 0:4.8.18-1.Final_redhat_00001.1.el6sso | 0:4.8.18-1.Final_redhat_00001.1.el6sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 |
before 0:4.8.18-1.Final_redhat_00001.1.el6sso | 0:4.8.18-1.Final_redhat_00001.1.el6sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 |
before 0:4.8.18-1.Final_redhat_00001.1.el7sso | 0:4.8.18-1.Final_redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 |
before 0:4.8.18-1.Final_redhat_00001.1.el7sso | 0:4.8.18-1.Final_redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el8 |
before 0:4.8.18-1.Final_redhat_00001.1.el8sso | 0:4.8.18-1.Final_redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el8 |
before 0:4.8.18-1.Final_redhat_00001.1.el8sso | 0:4.8.18-1.Final_redhat_00001.1.el8sso |
ansible-9openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 9.8.0-1.1 | 9.8.0-1.1 |
ansible-10openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 10.6.0-1.1 | 10.6.0-1.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ansible-11openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 11.11.0-1.1 | 11.11.0-1.1 |
ansible-12openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 12.2.0-1.1 | 12.2.0-1.1 |
ansible-13openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 13.7.0-1.1 | 13.7.0-1.1 |
ansible-14openSUSE:Tumbleweed From an advisory covering 45 CVEs |
before 14.6.0-1.1 | 14.6.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-1744 is a medium vulnerability (CVSS 5.6) in Keycloak, published March 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in org.keycloak:keycloak-core 9.0.1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1744
access.redhat.com/security/cve/CVE-2020-1744
nvd.nist.gov/vuln/detail/CVE-2020-1744
github.com/advisories/GHSA-4gf2-xv97-63m2
Show 58 moreShow less
issues.redhat.com/browse/KEYCLOAK-12379
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0945.json
cve.org/CVERecord?id=CVE-2020-1744
suse.com/security/cve/CVE-2016-9587
lists.opensuse.org/archives/list/[email protected]/thread/7LWEIR2LXW4QRWCY6HDMLUO2OTX5OZIC
Left out here: 58 versions. The JSON record has them.