Missing HTTP Security Headers in Keycloak Admin Console

CVE-2020-1728

What is CVE-2020-1728?

All versions of Keycloak contain a vulnerability where the Admin Console pages lack essential HTTP security headers in their HTTP responses. While this flaw does not directly lead to a security breach, it significantly increases the likelihood of exploitation by attackers. The absence of these headers can make the application vulnerable to various threats, including Clickjacking and channel downgrade attacks, as well as other client-based attack vectors. It is crucial for users to be aware of this vulnerability and implement necessary mitigations to enhance the overall security posture.

References