Read the docs
TI-2020-01672 Aliases CVE-2020-1728GHSA-3gg7-9q2x-79fc

Clickjacking in [UNKNOWN] keycloak

Priority LOW 26CWE-358Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 7 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-1021.

Summary

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more prone to Clickjacking, channel downgrade attacks and other similar client-based attack vectors.

Why it matters now

EPSS 0.00783 56th percentileScored 2026-11-07
Fix Partial Red Hat: 7 advisoriesRed Hat: 7 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]keycloakall versions—No fix listedCNA
—org.keycloak:keycloak-core (Maven)up to 9.0.3—No fix listedGHSA-3gg7-9q2x-79fc
  • keycloak Vendor[UNKNOWN] Affected all versions Fixed in — No fix listed CNA
  • org.keycloak:keycloak-core (Maven) Vendor— Affected up to 9.0.3 Fixed in — No fix listed GHSA-3gg7-9q2x-79fc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*before 10.0.0VulnerableRed Hat
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*up to 1.4.2Vulnerablequarkusio
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 10.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions up to 1.4.2 Vulnerable ·quarkusio

Remediation

Red Hat 7 advisories

  • RHSA-2020:4252 Released 2020-10-14 · Red Hat rating Important
    Red Hat build of Quarkus 1.7.5 release and security update
    • Red Hat build of Quarkus 1.7.5
  • RHSA-2020:4213 Released 2020-10-08 · Red Hat rating Low
    Red Hat support for Spring Boot 2.2.10 security update
    • Red Hat Runtimes Spring Boot 2.2.10
  • RHSA-2020:3539 Released 2020-09-02 · Red Hat rating Important
    Red Hat build of Thorntail 2.7.1 security and bug fix update
    • Text-Only RHOAR
Show 4 more Red Hat advisories
  • RHSA-2020:3501 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update
    • Red Hat Single Sign-On 7.4.2
  • RHSA-2020:3497 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.4 for RHEL 8 rh-sso7-keycloak-9.0.5-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-9.0.5-1.redhat_00001.1.el8sso
  • RHSA-2020:3496 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.4 for RHEL 7 Server rh-sso7-keycloak-9.0.5-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-9.0.5-1.redhat_00001.1.el7sso
  • RHSA-2020:3495 Released 2020-08-18 · Red Hat rating Important
    Red Hat Single Sign-On 7.4.2 security update on RHEL 6
    • Red Hat Single Sign-On 7.4 for RHEL 6 Server rh-sso7-keycloak-9.0.5-1.redhat_00001.1.el6sso, rh-sso7-keycloak-server-9.0.5-1.redhat_00001.1.el6sso

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Application RuntimesAffectedNo fix planned: Out of support scope
Red Hat build of QuarkusAffectedNo fix yet
Red Hat support for Spring BootAffectedNo fix yet
Red Hat Runtimes Spring Boot 2.2.10Fixed RHSA-2020:4213
Red Hat Single Sign-On 7.4 for RHEL 6 ServerFixed RHSA-2020:3495
Red Hat Single Sign-On 7.4 for RHEL 7 ServerFixed RHSA-2020:3496
Red Hat Single Sign-On 7.4 for RHEL 8Fixed RHSA-2020:3497
Red Hat Single Sign-On 7.4.2Fixed RHSA-2020:3501
Red Hat build of Quarkus 1.7.5Fixed RHSA-2020:4252
Text-Only RHOARFixed RHSA-2020:3539
Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1728
  2. 2026-10-03 Alias added: GHSA-3gg7-9q2x-79fc

References

Advisory 2

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences