3.5
Low
CVE-2023-2585 Keycloak's device authorization grant does not correctly validate the device code and client ID
Description
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 7 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Versions not published | |
| RHEL-8 based Middleware Containers 7.6 | earliest → < 7.6-24 | 7.6-24 |
References
- RHSA-2023:3883 access.redhat.com
- RHSA-2023:3884 access.redhat.com
- RHSA-2023:3885 access.redhat.com
- RHSA-2023:3888 access.redhat.com
- RHSA-2023:3892 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2196335 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Single Sign-On 7
The 285 CVEs of Red Hat Single Sign-On 7 →
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
High
CVE-2026-97175
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
8.8
High
CVE-2026-97174
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
6.8
Medium
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
High