CVE-2023-6291
26.01.2024, 15:15
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
| Vendor | Product | Version |
|---|---|---|
| redhat | keycloak | 𝑥 < 22.0.7 |
| redhat | single_sign-on | - |
| redhat | openshift_container_platform | 4.11 |
| redhat | openshift_container_platform | 4.12 |
| redhat | openshift_container_platform_for_ibm_z | 4.9 |
| redhat | openshift_container_platform_for_ibm_z | 4.10 |
| redhat | openshift_container_platform_for_linuxone | 4.9 |
| redhat | openshift_container_platform_for_linuxone | 4.10 |
| redhat | openshift_container_platform_for_power | 4.9 |
| redhat | openshift_container_platform_for_power | 4.10 |
| redhat | single_sign-on | 7.6 |
| redhat | migration_toolkit_for_applications | 6.0 |
| redhat | migration_toolkit_for_applications | 7.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References