Vulnerability · Published Jul 7, 2022 · Assigned by redhat
CVE-2022-1245
Critical 9.8
In plain English
A critical-severity missing authorization in keycloak. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.4%top 26.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.keycloak:keycloak-services | 18.0.0 | GHSA-75p6-52g3-rqc8 |
Affected products (as reported)
Weakness: CWE-862