CVE-2019-14837

CVE-2019-14837 is a critical vulnerability in Keycloak versions prior to 8.0.0 and Red Hat Single Sign-On, allowing an attacker to reset user passwords and gain unauthorized access. By owning the 'placeholder.org' domain and knowing a client's name, an attacker can intercept password reset emails sent to automatically generated service accounts (e.g., [email protected]). This flaw has a CVSS score of 9.1 (Critical) due to its network-based attack vector, low complexity, and high impact on confidentiality and integrity. While no public exploits, Metasploit modules, or Nuclei templates are currently available, and there's minimal community discussion, the potential for unauthorized account takeover remains significant.