CVE-2020-1728: 
Java vulnerability analysis and mitigation

A vulnerability was found in all versions of Keycloak where the Admin Console area of the application was missing general HTTP security headers in HTTP-responses. While this issue (CVE-2020-1728) does not directly lead to a security vulnerability, it could potentially aid attackers in exploiting other vulnerabilities. The vulnerability was fixed in Keycloak version 10.0.0 (Red Hat Bugzilla).

The vulnerability stems from the complete absence of general HTTP security headers in HTTP-responses within the Admin Console area. This security oversight makes the servers unnecessarily susceptible to various client-based attack vectors. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N (NVD).

The absence of security headers could make the servers more vulnerable to Clickjacking, channel downgrade attacks, and other similar client-based attack vectors. While not directly exploitable, this vulnerability could assist attackers in their efforts to exploit other security issues (Red Hat Bugzilla).

The vulnerability has been fixed in Keycloak version 10.0.0. Red Hat has released several security updates to address this issue across different products, including Red Hat Single Sign-On 7.4.2 (Red Hat Advisory).