Vulnerability record · CVE-2019-14837 · published 7 January 2020

CVE-2019-14837: Redhat keycloak hard-coded credentials vulnerability

Redhat · Keycloak

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.

9.1 CVSS 3.1 Critical EPSS 1.7% · top 22.3% CWE-547 · CWE-547CWE-798 · Hard-coded credentials

9.1CVSS 3.1 base score, v2 6.4

1.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

2Affected product versions listed by NVD

6References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Keycloak Redhat

Single Sign On Redhat

References

Link	Tags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14837	ExploitIssue TrackingVendor Advisory
https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f	PatchThird Party Advisory
https://issues.jboss.org/browse/KEYCLOAK-10780	Issue TrackingPermissions RequiredVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14837	ExploitIssue TrackingVendor Advisory
https://github.com/keycloak/keycloak/commit/9a7c1a91a59ab85e7f8889a505be04a71580777f	PatchThird Party Advisory
https://issues.jboss.org/browse/KEYCLOAK-10780	Issue TrackingPermissions RequiredVendor Advisory

Track CVE-2019-14837 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2023-44487HTTP/2 Rapid Reset stream cancellation denial of serviceThe HTTP/2 protocol permits a client to cancel many streams quickly, and the server's handling of those resets consumes disproportionate resources. T…KEVEPSS 100%analysed10 Oct 2023 9.8CVE-2026-49875Apache cxf xml external entity (xxe) vulnerabilityApache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configuration…EPSS 0.53%12 Jun 2026 9.8CVE-2022-4039Redhat single sign-on incorrect default permissions vulnerabilityA flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This …EPSS 0.79%22 Sep 2023 9.8CVE-2022-1245Redhat keycloak missing authorization vulnerabilityA privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid ac…EPSS 1.4%8 Jul 2022 9.8CVE-2019-14910Redhat keycloak improper authentication vulnerabilityA vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDA…EPSS 1.1%5 Dec 2019 9.8CVE-2019-10212Redhat undertow sensitive information in log file vulnerabilityA flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to o…EPSS 1.9%2 Oct 2019 9.8CVE-2019-14379Fasterxml jackson-databind prototype pollution vulnerabilitySubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transact…EPSS 8.0%29 Jul 2019 9.6CVE-2025-12543Redhat build of apache camel improper input validation vulnerabilityA flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to pr…EPSS 1.3%7 Jan 2026

Source: NIST National Vulnerability Database (record CVE-2019-14837), CISA KEV, FIRST EPSS (scores of 2026-11-11). This page is refreshed as NVD updates the record.