GitHub Advisoryadvisory · Maven

GHSA-7fpj-9hr8-28vh Keycloak vulnerable to impersonation via logout token exchange

LOW Published 2024-04-17 Modified 2024-11-18 Official page ↗
Aliases
CVE-2023-0657
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Low
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-273, CWE-284, CWE-287, CWE-290, CWE-347
Reviewed
2024-04-17

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.10 → fixed in 22.0.10 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.3 → fixed in 24.0.3

Description

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

Related

Alias · CVE (1)

Weakness · CWE (5)

  • CWE-273 Improper Check for Dropped Privileges weakness
  • CWE-284 Improper Access Control weakness
  • CWE-287 Improper Authentication weakness
  • CWE-290 Authentication Bypass by Spoofing weakness
  • CWE-347 Improper Verification of Cryptographic Signature weakness

References