CVE-2020-1724: 
Java vulnerability analysis and mitigation

A privacy vulnerability was discovered in Keycloak versions before 9.0.2, identified as CVE-2020-1724. The vulnerability allows a malicious user who is currently logged in to view the personal information of a previously logged out user in the account manager section (NVD, Red Hat Bugzilla).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue specifically affects the account manager section of Keycloak, where session management and user privacy controls were not properly implemented (NVD).

When exploited, this vulnerability allows authenticated users to access personal information of previously logged out users through the account manager section, leading to a privacy breach and potential exposure of sensitive user data (Red Hat Bugzilla).

The vulnerability requires an attacker to be authenticated in the system (logged in) to exploit the flaw. The attack complexity is considered low, as it does not require special access conditions beyond having a valid user account (NVD).

The vulnerability was fixed in Keycloak version 9.0.2. Users and administrators are strongly advised to upgrade to this version or later to address the privacy issue. The fix was also included in various Red Hat product updates, including Red Hat Single Sign-On 7.3 for RHEL 6, 7, and 8 (Red Hat Errata).