CVE-2023-6927
Medium
Description
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
SeverityMedium
CVSS4.6
Exploit probability—
Product
Redhat Keycloak
PublishedDec 18, 2023
First seenDec 18, 2023
Weakness typeCWE-601Open redirect
How to fix
Update
- org.keycloak:keycloak-core23.0.4 or later
Vendor advisories
- access.redhat.com/errata/RHSA-2024:0094
- access.redhat.com/errata/RHSA-2024:0095
- access.redhat.com/errata/RHSA-2024:0096
- access.redhat.com/errata/RHSA-2024:0097
- access.redhat.com/errata/RHSA-2024:0098
- access.redhat.com/errata/RHSA-2024:0100
- access.redhat.com/errata/RHSA-2024:0101
- access.redhat.com/errata/RHSA-2024:0798
- access.redhat.com/errata/RHSA-2024:0799
- access.redhat.com/errata/RHSA-2024:0800
- access.redhat.com/errata/RHSA-2024:0801
- access.redhat.com/errata/RHSA-2024:0804
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat keycloak | No range specified | — |
| redhat single_sign-on | 7.0 | — |
| org.keycloak:keycloak-coreMaven | v < 23.0.4 | 23.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.