CVE-2020-14389 and KeyCloak 10.x

2

IMHO it won’t be backported. There is no concept of LTS releases for the Keycloak: LTS policy and supported versions, recommended versions - #3 by ieugen
So you have to use the latest release.