CVE-2019-14910

No fix known EPSS 1%CVSS 9.3

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.

Published 2019-12-05 · CVE record · OSV

Products: redhat keycloak

Affected upstream, no fix yet