Skip to content
fr Sign in
4.6 Medium

CVE-2023-6927 A flaw was found in Keycloak

Description

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

Affected products and versions

Product Affected versions Fixed in
Red Hat build of Keycloak 22 22 earliest → < 22-7 22-7
Red Hat build of Keycloak 22.0.8 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-41 7.6-41
Single Sign-On 7.6.6 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat build of Keycloak 22

The 18 CVEs of Red Hat build of Keycloak 22 →
CVE-2023-0657 A flaw was found in Keycloak 3.4 Low CVE-2024-8883 A misconfiguration flaw was found in Keycloak 6.1 Medium CVE-2024-8698 A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class 7.7 High CVE-2024-7341 A session fixation issue was discovered in the SAML adapters provided by Keycloak 7.1 High
Track this CVE