CVE-2019-14910: Keycloak: LDAP authentication accepts invalid passwords when using StartTLS

Severity: Critical

CVSS Score: 9.8

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.