← CVE Intelligence

CVE-2023-6291

Keycloak: redirect_uri validation bypass PUBLISHED

Description (CNA)

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 22unaffected 22.0.7-1 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-6 before *
Red Hat / Red Hat build of Keycloak 22unaffected 22-9 before *
Red Hat / Red Hat build of Keycloak 22.0.7unaffected
Red Hat / Red Hat Single Sign-On 7unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.11-2.redhat_00003.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.12-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.11-2.redhat_00003.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.12-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.11-2.redhat_00003.1.el9sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.12-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-38 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6.6-2 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-41 before *
Red Hat / Single Sign-On 7.6.6unaffected
Red Hat / Migration Toolkit for Applications 6affected
Red Hat / Migration Toolkit for Applications 7unaffected
Red Hat / OpenShift Serverlessunaffected
Red Hat / Red Hat Data Grid 8unaffected
Red Hat / Red Hat Decision Manager 7unaffected
Red Hat / Red Hat Fuse 7unaffected
Red Hat / Red Hat JBoss Data Grid 7unaffected
Red Hat / Red Hat JBoss Enterprise Application Platform 6unaffected
Red Hat / Red Hat Process Automation 7unaffected

CWE

CWE-601

References

ADP enrichment

CVE

No English description supplied.

CISA-ADP

No English description supplied.

No references supplied.