CVE-2023-6291

Fixed in a distro release EPSS <1%CVSS 7.1

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Published 2024-01-26 · CVE record · OSV

Products: Red Hat build of Keycloak 22, Red Hat build of Keycloak 22.0.7, Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9, Red Hat RHEL-8 based Middleware Containers, Red Hat Single Sign-On 7.6.6, Red Hat Migration Toolkit for Applications 6, Red Hat Migration Toolkit for Applications 7, Red Hat OpenShift Serverless, Red Hat Data Grid 8, Red Hat Decision Manager 7, Red Hat Fuse 7, Red Hat JBoss Data Grid 7, Red Hat JBoss Enterprise Application Platform 6, Red Hat Process Automation 7

Fixed upstream

Distro releases