CVE-2020-27838 Keycloak discloses information without authentication

What is CVE-2020-27838?

CVE-2020-27838 is a medium-severity vulnerability in Redhat Keycloak, published on 8 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.

Weakness: CWE-287

Which versions are affected by CVE-2020-27838?

2 open source packages ship an affected version, including org.keycloak:keycloak-core. It affects 2 products.

Products include Redhat Keycloak, Redhat Single Sign-On.

How do I fix CVE-2020-27838?

Upgrade org.keycloak:keycloak-core to 13.0.0 or later.

Is CVE-2020-27838 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-27838 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in Redhat Keycloak

• CVE-2022-4361 Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC Critical 10.0
• CVE-2022-1245 Keycloak vulnerable to privilege escalation on Token Exchange feature Critical 9.8
• CVE-2021-20195 keycloak Self Stored Cross-site Scripting vulnerability Critical 9.6
• CVE-2019-14910 Keycloak Authentication Error Critical 9.3
• CVE-2019-14909 Keycloak Authentication Error Critical 9.3

All Redhat Keycloak vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pcv5-m2wh-66j3.