CVE-2019-14837

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 8.0.0

Description A flaw in Keycloak allows the owner of a domain to set up a mail server and reset a client's password, knowing only the client's name. For instance, a client named 'test' would have an email address like 'service-account-test@placeholder.org'. This issue is related to the use of predefined registration data, which can be exploited by a remote attacker to gain unauthorized access to protected information.

Recommendations For versions prior to 8.0.0, update to version 8.0.0 or later to resolve the issue.