← CVE Intelligence

CVE-2023-6927

Keycloak: open redirect via "form_post.jwt" jarm response mode PUBLISHED

Description (CNA)

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

Affected (CNA)

Vendor / productVersions
Red Hat / Red Hat build of Keycloak 22unaffected 22-7 before *
Red Hat / Red Hat build of Keycloak 22.0.8unaffected
Red Hat / Red Hat Single Sign-On 7unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.11-3.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7unaffected 0:18.0.12-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.11-3.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8unaffected 0:18.0.12-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.11-3.redhat_00001.1.el9sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9unaffected 0:18.0.12-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-39 before *
Red Hat / RHEL-8 based Middleware Containersunaffected 7.6-41 before *
Red Hat / Single Sign-On 7.6.6unaffected

CWE

CWE-601

References

ADP enrichment

CVE

No English description supplied.