Missing HTTP Security Headers in Keycloak Admin Console

CVE-2020-1728

What is CVE-2020-1728?

All versions of Keycloak contain a vulnerability where the Admin Console pages lack essential HTTP security headers in their HTTP responses. While this flaw does not directly lead to a security breach, it significantly increases the likelihood of exploitation by attackers. The absence of these headers can make the application vulnerable to various threats, including Clickjacking and channel downgrade attacks, as well as other client-based attack vectors. It is crucial for users to be aware of this vulnerability and implement necessary mitigations to enhance the overall security posture.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References