CVE-2020-1714: Improper Input Validation in Keycloak
Summary
CVE-2020-1714: Improper Input Validation in Keycloak. Affects org.keycloak:keycloak-core versions < 11.0.0. Fixed in 11.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that provides single sign-on, social login, and user federation capabilities. It is widely used to secure web applications and services. The Keycloak parent package, specifically versions prior to 11.0.0, is affected by a vulnerability that allows an attacker to inject malicious serialized Java Objects. This vulnerability arises from the usage of ObjectInputStream without proper type checks. Exploiting this flaw can lead to remote code execution in a privileged context.
Vulnerability Detail
The vulnerability (CVE-2020-1714) in Keycloak arises due to the lack of input validation in the code base. By injecting malicious serialized Java Objects, an attacker can exploit this flaw to execute arbitrary code in a privileged context. This can result in severe consequences, including unauthorized access, data breaches, and complete compromise of the affected system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, it is recommended to implement input validation and enforce strict deserialization policies. This can be achieved by implementing custom deserialization filters or using libraries that provide secure deserialization mechanisms. By validating and sanitizing user input, the risk of deserialization attacks can be mitigated.
Conclusion
The vulnerability (CVE-2020-1714) in Keycloak allows an attacker to inject malicious serialized Java Objects, potentially leading to remote code execution. To mitigate this vulnerability, it is crucial to upgrade the Keycloak parent package to version 11.0.0 or later. Implementing input validation and enforcing strict deserialization policies can serve as temporary workarounds. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides single sign-on, social login, and user federation capabilities. It is widely used to secure web applications and services.
Exploiting this vulnerability can lead to remote code execution in a privileged context. This can result in unauthorized access, data breaches, and complete compromise of the affected system.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
To fix this vulnerability, it is recommended to upgrade the Keycloak parent package to version 11.0.0 or later. This version includes the necessary fixes and improvements to prevent the injection of malicious serialized Java Objects.
As a workaround, if upgrading to the latest version is not immediately feasible, it is recommended to implement input validation and enforce strict deserialization policies. This can be achieved by implementing custom deserialization filters or using libraries that provide secure deserialization mechanisms.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
