{"vulnerability": "cve-2020-27838", "sightings": [{"uuid": "cff74e81-2cec-40c8-873f-d6ae556d8e8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/arpsyndicate/4758", "content": "#ExploitObserverAlert\n\nCVE-2020-27838\n\nDESCRIPTION: Exploit Observer has 12 entries in 5 file formats related to CVE-2020-27838. A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.\n\nFIRST-EPSS: 0.088000000\nNVD-IS: 3.6\nNVD-ES: 2.8\nARPS-PRIORITY: 0.9055936", "creation_timestamp": "2024-04-23T18:25:40.000000Z"}, {"uuid": "a1b22be8-6a2b-465d-beaf-b8a2deca5558", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/arpsyndicate/3163", "content": "#ExploitObserverAlert\n\nCVE-2020-27838\n\nDESCRIPTION: Exploit Observer has 6 entries in 5 file formats related to CVE-2020-27838. A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.\n\nFIRST-EPSS: 0.081350000\nNVD-IS: 3.6\nNVD-ES: 2.8", "creation_timestamp": "2024-01-28T02:18:09.000000Z"}, {"uuid": "ec41457e-6599-4a78-b10d-0434244c19ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/arpsyndicate/2913", "content": "#ExploitObserverAlert\n\nCVE-2020-27838\n\nDESCRIPTION: Exploit Observer has 5 entries in 3 file formats related to CVE-2020-27838. A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.\n\nFIRST-EPSS: 0.081350000\nNVD-IS: 3.6\nNVD-ES: 2.8", "creation_timestamp": "2024-01-19T09:03:04.000000Z"}, {"uuid": "0d07c774-611d-4730-acbf-5f2b676c039f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/arpsyndicate/2942", "content": "#ExploitObserverAlert\n\nPD/http/cves/2020/CVE-2020-27838\n\nDESCRIPTION: Exploit Observer has 4 entries in 3 file formats related to PD/HTTP/CVES/2020/CVE-2020-27838. A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.", "creation_timestamp": "2024-01-19T17:10:10.000000Z"}, {"uuid": "9024e9e8-4c3e-471c-9a1d-f3ce16b11f9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/hacking_Attack/142245", "content": "A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure\n\nA Story About CVE-2020\u201327838 in TVH responsible disclosure A few months ago, during a security assessment of a client\u2019s system, I stumbled upon a critical flaw in the TVH authentication server that could expose sensitive information. This vulnerability, identified as CVE-2020\u201327838, allows unauthorized access to client registration details in Keycloak, potentially compromising the confidentiality of sensitive data. Here\u2019s how I discovered and explored this vulnerability.The Discovery While testing the TVH authentication server, I identified a vulnerability in the Keycloak client registration endpoint that allowed information exposure without proper authentication. Specifically, I found that the endpoint at https://xxxxxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console was leaking sensitive details.Understanding the VulnerabilityBug Name: Information ExposureBug Priority: MediumVulnerable URL: https://xxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console CVE Description: This vulnerability was found in Keycloak versions prior to 13.0.0. The issue lies in the client registration endpoint, which allows fetching information about PUBLIC clients, including the client secret, without requiring authentication. This becomes particularly dangerous if a PUBLIC client is later switched to CONFIDENTIAL status, as the previously exposed secrets could still be accessed without proper authorization. The highest risk from this flaw is the potential compromise of data confidentiality.Impact The vulnerability allows an attacker to gain sensitive information from the Keycloak server, which could be exploited to access or manipulate client data. This could lead to unauthorized access to confidential information, potentially compromising the integrity of the affected system.Automating the Hunt To streamline the process of identifying this vulnerability, I developed a Python tool that automates the testing of the vulnerable endpoint. You can easily install and use this tool as follows: ToolPOC: CVE-2020\u201327838 on githubpip install CVE-2020-27838 CVE-2020-27838 --chatid To Check a Single URL:CVE-2020-27838 -u http://mytargetprogram.comTo Check a List of URLs:CVE-2020-27838 -i urls.txtProof of Concept (POC) To demonstrate the vulnerability, the tool automates the process of testing the endpoint for information exposure. Here\u2019s a sample POC image:POC ImageRemediation To mitigate this vulnerability, it is essential to apply the latest security patches or updates provided by the Keycloak vendor. Updating to a version later than 13.0.0 will resolve this issue by requiring proper authentication before accessing sensitive client information. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com. For enrolling my cybersecurity and Bugbounty course, WhatsApp +91 82709 13635.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-01T20:00:30.982591Z"}, {"uuid": "671266d7-33f2-4367-b8cc-a6573bc167dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/hacking_Attack/141852", "content": "A few months ago, during a security assessment of a client\u2019s system, I stumbled upon a critical flaw in the TVH authentication server that\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/a-story-about-how-i-found-cve-2020-27838-in-tvh-responsible-disclosure-16946f8f8faf?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-01T20:00:31.110390Z"}, {"uuid": "6417c271-8e9f-48b1-b29d-ffcb62a9855d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/hacking_Attack/141850", "content": "A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure\nhttps://medium.com/@karthithehacker/a-story-about-how-i-found-cve-2020-27838-in-tvh-responsible-disclosure-16946f8f8faf?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-01T20:00:31.392757Z"}, {"uuid": "b9fe54fb-394e-4f90-8291-e26be130fbe4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/hacking_Attack/141852", "content": "A few months ago, during a security assessment of a client\u2019s system, I stumbled upon a critical flaw in the TVH authentication server that\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/a-story-about-how-i-found-cve-2020-27838-in-tvh-responsible-disclosure-16946f8f8faf?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-02T01:00:49.037090Z"}, {"uuid": "d69982c8-fb2a-4865-8149-397b53f6b248", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/hacking_Attack/142245", "content": "A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure\n\nA Story About CVE-2020\u201327838 in TVH responsible disclosure A few months ago, during a security assessment of a client\u2019s system, I stumbled upon a critical flaw in the TVH authentication server that could expose sensitive information. This vulnerability, identified as CVE-2020\u201327838, allows unauthorized access to client registration details in Keycloak, potentially compromising the confidentiality of sensitive data. Here\u2019s how I discovered and explored this vulnerability.The Discovery While testing the TVH authentication server, I identified a vulnerability in the Keycloak client registration endpoint that allowed information exposure without proper authentication. Specifically, I found that the endpoint at https://xxxxxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console was leaking sensitive details.Understanding the VulnerabilityBug Name: Information ExposureBug Priority: MediumVulnerable URL: https://xxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console CVE Description: This vulnerability was found in Keycloak versions prior to 13.0.0. The issue lies in the client registration endpoint, which allows fetching information about PUBLIC clients, including the client secret, without requiring authentication. This becomes particularly dangerous if a PUBLIC client is later switched to CONFIDENTIAL status, as the previously exposed secrets could still be accessed without proper authorization. The highest risk from this flaw is the potential compromise of data confidentiality.Impact The vulnerability allows an attacker to gain sensitive information from the Keycloak server, which could be exploited to access or manipulate client data. This could lead to unauthorized access to confidential information, potentially compromising the integrity of the affected system.Automating the Hunt To streamline the process of identifying this vulnerability, I developed a Python tool that automates the testing of the vulnerable endpoint. You can easily install and use this tool as follows: ToolPOC: CVE-2020\u201327838 on githubpip install CVE-2020-27838 CVE-2020-27838 --chatid To Check a Single URL:CVE-2020-27838 -u http://mytargetprogram.comTo Check a List of URLs:CVE-2020-27838 -i urls.txtProof of Concept (POC) To demonstrate the vulnerability, the tool automates the process of testing the endpoint for information exposure. Here\u2019s a sample POC image:POC ImageRemediation To mitigate this vulnerability, it is essential to apply the latest security patches or updates provided by the Keycloak vendor. Updating to a version later than 13.0.0 will resolve this issue by requiring proper authentication before accessing sensitive client information. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com. For enrolling my cybersecurity and Bugbounty course, WhatsApp +91 82709 13635.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-02T01:00:48.927146Z"}, {"uuid": "4b08384f-cace-46e7-9dab-0566dc2c733a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "seen", "source": "https://t.me/hacking_Attack/141850", "content": "A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure\nhttps://medium.com/@karthithehacker/a-story-about-how-i-found-cve-2020-27838-in-tvh-responsible-disclosure-16946f8f8faf?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-02T01:00:49.423943Z"}, {"uuid": "51d2c8ce-8fb5-4614-9a03-1e84c0521956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/141850", "content": "A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure\nhttps://medium.com/@karthithehacker/a-story-about-how-i-found-cve-2020-27838-in-tvh-responsible-disclosure-16946f8f8faf?source=rss------bug_bounty-5", "creation_timestamp": "2026-09-03T17:00:04.914382Z"}, {"uuid": "01163d0c-194f-4720-b38a-47209e6219f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/142245", "content": "A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure\n\nA Story About CVE-2020\u201327838 in TVH responsible disclosure A few months ago, during a security assessment of a client\u2019s system, I stumbled upon a critical flaw in the TVH authentication server that could expose sensitive information. This vulnerability, identified as CVE-2020\u201327838, allows unauthorized access to client registration details in Keycloak, potentially compromising the confidentiality of sensitive data. Here\u2019s how I discovered and explored this vulnerability.The Discovery While testing the TVH authentication server, I identified a vulnerability in the Keycloak client registration endpoint that allowed information exposure without proper authentication. Specifically, I found that the endpoint at https://xxxxxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console was leaking sensitive details.Understanding the VulnerabilityBug Name: Information ExposureBug Priority: MediumVulnerable URL: https://xxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console CVE Description: This vulnerability was found in Keycloak versions prior to 13.0.0. The issue lies in the client registration endpoint, which allows fetching information about PUBLIC clients, including the client secret, without requiring authentication. This becomes particularly dangerous if a PUBLIC client is later switched to CONFIDENTIAL status, as the previously exposed secrets could still be accessed without proper authorization. The highest risk from this flaw is the potential compromise of data confidentiality.Impact The vulnerability allows an attacker to gain sensitive information from the Keycloak server, which could be exploited to access or manipulate client data. This could lead to unauthorized access to confidential information, potentially compromising the integrity of the affected system.Automating the Hunt To streamline the process of identifying this vulnerability, I developed a Python tool that automates the testing of the vulnerable endpoint. You can easily install and use this tool as follows: ToolPOC: CVE-2020\u201327838 on githubpip install CVE-2020-27838 CVE-2020-27838 --chatid To Check a Single URL:CVE-2020-27838 -u http://mytargetprogram.comTo Check a List of URLs:CVE-2020-27838 -i urls.txtProof of Concept (POC) To demonstrate the vulnerability, the tool automates the process of testing the endpoint for information exposure. Here\u2019s a sample POC image:POC ImageRemediation To mitigate this vulnerability, it is essential to apply the latest security patches or updates provided by the Keycloak vendor. Updating to a version later than 13.0.0 will resolve this issue by requiring proper authentication before accessing sensitive client information. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you\u2019re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com. For enrolling my cybersecurity and Bugbounty course, WhatsApp +91 82709 13635.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V A Story About How i Found CVE-2020\u201327838 in TVH responsible disclosure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-03T17:00:05.388627Z"}, {"uuid": "19db5e9d-c53a-4aaa-a31c-ee69a574e3f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-27838", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/141852", "content": "A few months ago, during a security assessment of a client\u2019s system, I stumbled upon a critical flaw in the TVH authentication server that\u2026Continue reading on Medium \u00bb (https://medium.com/@karthithehacker/a-story-about-how-i-found-cve-2020-27838-in-tvh-responsible-disclosure-16946f8f8faf?source=rss------bug_bounty-5)", "creation_timestamp": "2026-09-03T17:00:05.277764Z"}]}