What is CVE-2020-14302?

CVE-2020-14302 is a medium-severity vulnerability in Redhat Keycloak, classified under Authentication Bypass by Capture-replay. CVSS score: 4.9/10. Published 2020-12-15.

How severe is CVE-2020-14302?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Is CVE-2020-14302 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Redhat Keycloak

CVE-2020-14302

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

EPSS: 0.010 (59.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Redhat Keycloak
N/a Keycloak — versions keycloak 13.0.0

Weakness classification (CWE)

CWE-294 — Authentication Bypass by Capture-replay

Public proof-of-concept exploits

muneebaashiq/MBProjects

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-14302?: CVE-2020-14302 is a medium-severity vulnerability in Redhat Keycloak, classified under Authentication Bypass by Capture-replay. CVSS score: 4.9/10. Published 2020-12-15.
How severe is CVE-2020-14302?: Medium severity. CVSS v3 base score is 4.9 out of 10.
Is CVE-2020-14302 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.