Skip to content
Fencer Vulns
high 7.5

CVE-2020-1714 json

Improper Input Validation in Keycloak

published 2020-05-13 6 y ago modified 2026-06-17 4 mo ago also GHSA-m6mm-q862-j366 , EUVD-2022-1095

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.6%
EPSS 2.6% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

Patch / fix

  • maven org.keycloak:keycloak-core 11.0.0
  • maven org.keycloak:keycloak-common 11.0.0
  • redhat keycloak 11.0.0
  • eap7-keycloak-adapter-sso7_4 jboss enterprise application platform 7.3 9.0.4-1.redhat_00001.1.el6eap
  • eap7-keycloak-adapter-sso7_4 jboss enterprise application platform 7.3 9.0.4-1.redhat_00001.1.el7eap
  • eap7-keycloak-adapter-sso7_4 jboss enterprise application platform 7.3 9.0.4-1.redhat_00001.1.el8eap
  • eap7-keycloak-saml-adapter-sso7_4 jboss enterprise application platform 7.3 9.0.4-1.redhat_00001.1.el6eap
  • eap7-keycloak-saml-adapter-sso7_4 jboss enterprise application platform 7.3 9.0.4-1.redhat_00001.1.el7eap
  • eap7-keycloak-saml-adapter-sso7_4 jboss enterprise application platform 7.3 9.0.4-1.redhat_00001.1.el8eap
  • keycloak-adapter-sso7_4-eap6 jboss enterprise application platform 6 9.0.4-1.redhat_00001.1.ep6.el6
  • keycloak-adapter-sso7_4-eap6 jboss enterprise application platform 6 9.0.4-1.redhat_00001.1.ep6.el7

red hat advisories RHSA-2020:2814RHSA-2020:2816

  • keycloak Arch Linux 10.0.1-1

arch linux advisories AVG-1158

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-1714 updated cvss 7.5

keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution

  • Red Hat OpenShift Application Runtimes keycloak keycloak Red Hat Single Sign-On 7 rh-sso7-keycloak rh-sso7-keycloak Red Hat support for Spring Boot keycloak keycloak
    affected: workaround, no fix available “There is currently no known mitigation for this issue.”
  • Red Hat build of Quarkus 1.7.5
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:4252
  • Red Hat Decision Manager 7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3675
  • Red Hat Fuse 7.8.0
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:5568
  • Red Hat JBoss EAP 7.3 for BaseOS-8 eap7-keycloak-adapter-sso7_4 9.0.4-1.redhat_00001.1.el8eap, eap7-keycloak-saml-adapter-sso7_4 9.0.4-1.redhat_00001.1.el8eap Red Hat JBoss EAP 7.3 for RHEL 6 Server eap7-keycloak-adapter-sso7_4 9.0.4-1.redhat_00001.1.el6eap, eap7-keycloak-saml-adapter-sso7_4 9.0.4-1.redhat_00001.1.el6eap Red Hat JBoss EAP 7.3 for RHEL 7 Server eap7-keycloak-adapter-sso7_4 9.0.4-1.redhat_00001.1.el7eap, eap7-keycloak-saml-adapter-sso7_4 9.0.4-1.redhat_00001.1.el7eap
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:2814
  • Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server keycloak-adapter-sso7_4-eap6 9.0.4-1.redhat_00001.1.ep6.el6, keycloak-saml-adapter-sso7_4-eap6 9.0.4-1.redhat_00001.1.ep6.el6 Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server keycloak-adapter-sso7_4-eap6 9.0.4-1.redhat_00001.1.ep6.el7, keycloak-saml-adapter-sso7_4-eap6 9.0.4-1.redhat_00001.1.ep6.el7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:2816
  • Red Hat Process Automation 7
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3678
  • Red Hat Runtimes Spring Boot 2.1.15
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:3017
show 3 more
  • Red Hat Single Sign-On 7.4.1
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:2813
  • Red Hat Text-Only RHOAR
    fixed: vendor fix “There is currently no known mitigation for this issue.” RHSA-2020:2905
  • Red Hat Mobile Application Platform 4 keycloak
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.60% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.keycloak:keycloak-core
<11.0.0
11.0.0
maven org.keycloak:keycloak-common
<11.0.0
11.0.0

Affected products

  • Red Hat keycloak

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.