Riskcovery

CVE-2023-2585

Keycloak: client access via device auth request spoof

State
Published
Severity
3.5 Low
Published
Dec 21, 2023
Updated
Aug 2, 2024
Reserved
May 8, 2023

Read the record on cve.org

Description

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:Nredhat

Weaknesses

  • CWE-358 Improperly Implemented Security Check for Standard

Affected Products

ProductVersions
Red Hat Single Sign-On 7Red Hat
    Red Hat Single Sign-On 7.6 for RHEL 7Red Hat
    • 0:18.0.8-1.redhat_00001.1.el7sso and laterNot affected
    Red Hat Single Sign-On 7.6 for RHEL 8Red Hat
    • 0:18.0.8-1.redhat_00001.1.el8sso and laterNot affected
    Red Hat Single Sign-On 7.6 for RHEL 9Red Hat
    • 0:18.0.8-1.redhat_00001.1.el9sso and laterNot affected
    RHEL-8 based Middleware ContainersRed Hat
    • 7.6-24 and laterNot affected

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.