CVE-2023-0091: Input Validation
/clients-registrations/openid-connect could consume an invalidated token and register a new client.
Reproducer: 1. Generate a token for service-account using the clientcredentials flow 2. Revoke the token using the /revoke endpoint passing in the above token. 3. Now, invoke /clients-registrations/openid-connect passing in the above generated token for auth 4. A client is created using the token
Other sources
A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2023-0091?
CVE-2023-0091 is a vulnerability found in Keycloak where it did not properly check client tokens for possible revocation in its client credential flow.
What is the severity of CVE-2023-0091?
The severity of CVE-2023-0091 is low with a CVSS score of 3.8.
How does CVE-2023-0091 affect Keycloak?
CVE-2023-0091 affects Keycloak by allowing an attacker to access or modify potentially sensitive information.
Which versions of Keycloak are affected by CVE-2023-0091?
Versions 0:18.0.6-1.redhat_00001.1.el7, 0:18.0.6-1.redhat_00001.1.el8, and 0:18.0.6-1.redhat_00001.1.el9 of Keycloak are affected by CVE-2023-0091.
How can I fix CVE-2023-0091?
To fix CVE-2023-0091, you need to update Keycloak to a version that includes the necessary fixes, such as 0:18.0.6-1.redhat_00001.1.el7, 0:18.0.6-1.redhat_00001.1.el8, or 0:18.0.6-1.redhat_00001.1.el9.