3.5
Faible
CVE-2023-2585 Keycloak's device authorization grant does not correctly validate the device code and client ID
Description
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Single Sign-On 7 | Versions non publiées | |
| Red Hat Single Sign-On 7.6 for RHEL 7 | Versions non publiées | |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Versions non publiées | |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Versions non publiées | |
| RHEL-8 based Middleware Containers 7.6 | premières → < 7.6-24 | 7.6-24 |
Références
- RHSA-2023:3883 access.redhat.com
- RHSA-2023:3884 access.redhat.com
- RHSA-2023:3885 access.redhat.com
- RHSA-2023:3888 access.redhat.com
- RHSA-2023:3892 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2196335 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Single Sign-On 7
Les 294 CVE de Red Hat Single Sign-On 7 →
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Moyenne
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Moyenne
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Moyenne
CVE-2026-96460
Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
5.4
Moyenne