Generation of Error Message Containing Sensitive Information in Keycloak

LOW 2.7CVE-2020-1717 · GHSA-rvfc-g8j5-9ccf · Published 11/02/2021 · updated 17/06/2026

In short

CVE-2020-1717 is a LOW (CVSS 2.7) vulnerability affecting org.keycloak:keycloak-parent, jboss fuse (redhat), keycloak (redhat).
Chance of exploitation in the next 30 days (EPSS): 0.77%, higher than 55.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
org.keycloak:keycloak-parent Maven	`≤ 7.0.1`	No fix yet
jboss fuse redhat	`= 7.0.0`	No fix yet
keycloak redhat	`= 7.0.1`	No fix yet
single sign-on redhat	`= 7.0`	No fix yet

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.

NVD description

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

In short

CVE-2020-1717 is a LOW (CVSS 2.7) vulnerability affecting org.keycloak:keycloak-parent, jboss fuse (redhat), keycloak (redhat).

Chance of exploitation in the next 30 days (EPSS): 0.77%, higher than 55.5% of all vulnerabilities.

No patched version is listed yet: follow the vendor's advisory in References.

Package

Affected versions

Patched versions

Maven

≤ 7.0.1

No fix yet

= 7.0.0

No fix yet

= 7.0.1

No fix yet

= 7.0

No fix yet

More vulnerabilities in org.keycloak:keycloak-parent

See all →