CVE-2020-1725: 
Java vulnerability analysis and mitigation

CVE-2020-1725 is a security vulnerability discovered in Keycloak versions prior to 13.0.0. The vulnerability was identified where users could maintain access to resources even after their role mappings were changed in Keycloak and after the expiration of their previous access token (NVD, CVE).

The vulnerability is classified as an Incorrect Authorization issue (CWE-863) with a CVSS v3.1 Base Score of 5.4 (Medium) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The CVSS v2.0 Base Score is 5.5 (Medium) with vector (AV:N/AC:L/Au:S/C:P/I:P/A:N) (NVD).

The vulnerability allows users to retain access to resources even after their role mappings have been modified in Keycloak, effectively bypassing intended access control changes. This could lead to unauthorized access to resources that should have been restricted (NVD).

The vulnerability requires network access and low privilege levels to exploit, with no user interaction needed. The attack complexity is considered low, making it relatively straightforward to exploit if the conditions are met (NVD).

The vulnerability has been fixed in Keycloak version 13.0.0. Users are advised to upgrade to this version or later to address the security issue (NVD).