← CVE Intelligence

CVE-2023-2422

Keycloak: oauth client impersonation PUBLISHED

Description (CNA)

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat Single Sign-On 7unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.8-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.8-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.8-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-24 before *

CWE

CWE-295

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.