Tobias Friedrich

**Name of the Vulnerable Software and Affected Versions** Keycloak versions prior to 9.0.0 **Description** A flaw in the HttpMethod class may leak the password given as a parameter, posing a threat to data confidentiality. **Recommendations** For versions prior to 9.0.0, update to version 9.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive data handled by the HttpMethod class until a patch is applied. Avoid using the `password` parameter in affected API endpoints until the issue is resolved.