CVE-2020-1698

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 9.0.0

Description A flaw in the HttpMethod class may leak the password given as a parameter, posing a threat to data confidentiality.

Recommendations For versions prior to 9.0.0, update to version 9.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data handled by the HttpMethod class until a patch is applied. Avoid using the password parameter in affected API endpoints until the issue is resolved.