CVE-2020-1694: Red Hat Keycloak

Medium severity, CVSS 4.9. EPSS: 1.6% chance of exploitation in the next 30 days.

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

Affected products

• Red Hat Keycloak: before 10.0.0 (fixed in 10.0.0)

Published 2020-09-16. Last modified 2026-06-17.