CVE-2019-14837: Red Hat Keycloak

Critical severity, CVSS 9.1. EPSS: 1.7% chance of exploitation in the next 30 days.

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.

Affected products

• Red Hat Keycloak: before 8.0.0 (fixed in 8.0.0)
• Red Hat Single Sign-On: version 7.3 only

Published 2020-01-07. Last modified 2026-06-17.