Riskcovery

CVE-2024-4540

Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie

State
Published
Severity
7.5 High
Published
Jun 3, 2024
Updated
Oct 9, 2026
Reserved
May 6, 2024

Read the record on cve.org

Description

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nredhat

Weaknesses

  • CWE-312 Cleartext Storage of Sensitive Information

Affected Products

ProductVersions
keycloak
  • d5e82356f90893ca3b308a7e10020103e402369a and laterNot affected
Red Hat Build of KeycloakRed Hat
    Red Hat Build of KeycloakRed Hat
      Red Hat build of Keycloak 22Red Hat
      • 22.0.11-2 and laterNot affected
      Red Hat build of Keycloak 22Red Hat
      • 22-15 and laterNot affected
      Red Hat build of Keycloak 22Red Hat
      • 22-18 and laterNot affected
      Red Hat build of Keycloak 24Red Hat
      • 24.0.5-2 and laterNot affected
      Red Hat build of Keycloak 24Red Hat
      • 24-10 and laterNot affected
      Red Hat build of Keycloak 24Red Hat
      • 24-10 and laterNot affected
      Red Hat Single Sign-On 7Red Hat
        Red Hat Single Sign-On 7.6 for RHEL 7Red Hat
        • 0:18.0.14-1.redhat_00001.1.el7sso and laterNot affected
        Red Hat Single Sign-On 7.6 for RHEL 8Red Hat
        • 0:18.0.14-1.redhat_00001.1.el8sso and laterNot affected
        Red Hat Single Sign-On 7.6 for RHEL 9Red Hat
        • 0:18.0.14-1.redhat_00001.1.el9sso and laterNot affected
        RHEL-8 based Middleware ContainersRed Hat
        • 7.6-49 and laterNot affected

        References

        Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.