CVE-2020-27838: 
Java vulnerability analysis and mitigation

A vulnerability was discovered in Keycloak versions prior to 13.0.0 where the client registration endpoint allowed unauthorized access to information about PUBLIC clients, including sensitive data like client secrets. This vulnerability was assigned CVE-2020-27838 and was discovered by Adam Devoe from SemaTree Inc (Red Hat Bugzilla).

The vulnerability exists in the client registration endpoint of Keycloak, which allowed fetching information about PUBLIC clients without proper authentication. The issue becomes particularly concerning when a PUBLIC client is later changed to CONFIDENTIAL, as the previously exposed information could still be accessed. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (NVD).

The primary impact of this vulnerability is to data confidentiality. If exploited, an attacker could access sensitive client information, including client secrets, which could potentially lead to unauthorized access to protected resources. This is particularly critical when PUBLIC clients are converted to CONFIDENTIAL status, as their credentials would have been previously exposed (NVD).

The vulnerability can be exploited remotely without requiring authentication. The attack complexity is considered low, though it does require user interaction. The vulnerability affects the client registration endpoint specifically, and can be triggered by sending unauthenticated requests to fetch PUBLIC client information (NVD).

The vulnerability has been fixed in Keycloak version 13.0.0. Organizations using affected versions should upgrade to version 13.0.0 or later to address this security issue. For Red Hat Single Sign-On users, the fix is available in version 7.5.0 (Red Hat Bugzilla).