CVE-2019-14837

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be '[email protected]'...

CVE-2019-14837

Keycloak before version 8.0.0 is affected by a logic/identity flaw where the owner of the placeholder.org domain can configure a mail server on that domain and reset a client’s password using only the client name (e.g., [email protected]) to log in. The available public documen...