CVE-2020-27838
published 2021-03-08CVE-2020-27838: A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client…
PriorityP355medium6.5CVSS 3.1
AVNACLPRNUIRSUCHINAN
EXPLOIT
EPSS
17.94%
96.9th percentile
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | keycloak | < 13.0.0 | 13.0.0 |
| redhat | keycloak | — | — |
| redhat | single_sign-on | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
regex: '"clientId":\s*"security-admin-console"' AND '"secret":'
- →Send an unauthenticated HTTP GET to /auth/realms/master/clients-registrations/default/security-admin-console and look for a 200 response with Content-Type application/json containing both '"clientId":' matching 'security-admin-console' and a '"secret":' field — presence of the secret field without authentication confirms the vulnerability. ↗
- →Match response body with regex for both '"clientId":\s*"security-admin-console"' AND '"secret":' simultaneously (AND condition) to confirm secret exposure. ↗
- →Confirm the response header contains 'application/json' to avoid false positives on error pages. ↗
- →Use Shodan queries 'title:"keycloak"', 'http.title:"keycloak"', 'http.html:"keycloak"', or favicon hash -1105083093 to identify exposed KeyCloak instances for targeted scanning. ↗
- →The affected package in Red Hat Single Sign-On 7 is 'rh-sso7-keycloak'; scope detection efforts to instances running versions prior to 13.0.0. ↗
- ·The vulnerability only manifests if a client was originally registered as PUBLIC and was later changed to CONFIDENTIAL — a purely CONFIDENTIAL client registered from the start may not be exposed via this endpoint. ↗
- ·Only KeyCloak versions prior to 13.0.0 are affected; instances already upgraded to 13.0.0 or later are not vulnerable. ↗
- ·Several Red Hat packages bundling keycloak (Decision Manager 7, Fuse 7, Camel K 1, OpenShift Application Runtimes, Process Automation 7, support for Spring Boot) are explicitly marked Not Affected; only rh-sso7-keycloak in Red Hat Single Sign-On 7 is confirmed Affected. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Keycloak discloses information without authentication
osv·2022-05-24
CVE-2020-27838 [MEDIUM] Keycloak discloses information without authentication
Keycloak discloses information without authentication
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
GHSA
Keycloak discloses information without authentication
ghsa·2022-05-24
CVE-2020-27838 [MEDIUM] CWE-287 Keycloak discloses information without authentication
Keycloak discloses information without authentication
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
Red Hat
keycloak: Exploiting the client registration API
vendor_redhat·2020-12-11·CVSS 6.5
CVE-2020-27838 [MEDIUM] CWE-287 keycloak: Exploiting the client registration API
keycloak: Exploiting the client registration API
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
A flaw was found in keycloak. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
Package: keycloak (Red Hat Decision Manager 7) - Not affected
Package: keycloak (Red Hat Fuse 7) - Not
No detection rules found.
Nuclei
KeyCloak - Information Exposure
nuclei·CVSS 6.5
CVE-2020-27838 [MEDIUM] KeyCloak - Information Exposure
KeyCloak - Information Exposure
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.
Template:
id: CVE-2020-27838
info:
name: KeyCloak - Information Exposure
author: mchklt
severity: medium
description: |
A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability
No writeups or analysis indexed.
2021-03-08
Published