Log in Start free

Vulnerability · Published Dec 18, 2023 · Assigned by redhat

CVE-2023-6927Keycloak: open redirect via "form_post.jwt" jarm response mode

Medium 4.6

In plain English

A medium-severity open redirect in Red Hat build of Keycloak 22 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)1.1%top 34.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.keycloak:keycloak-core23.0.4GHSA-9vm7-v8wj-3fqw

Affected products (as reported)

VendorProductVersions
Red Hat Red Hat build of Keycloak 22 see references
Red Hat Red Hat build of Keycloak 22.0.8 see references
Red Hat Red Hat Single Sign-On 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 see references
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9 see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat RHEL-8 based Middleware Containers see references
Red Hat Single Sign-On 7.6.6 see references

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

References