CVE-2023-6927: Keycloak: open redirect via "form_post.jwt" jarm response mode
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references.
Original Description A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
Other sources
An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt". It is observed that changing the responsemode parameter in the original proof of concept from "formpost" to "formpost.jwt" can bypass the security patch implemented to address CVE-2023-6134.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-coreto a version that resolves this vulnerability.Fixed in 23.0.4 - Upgrade
Upgrade
redhat/keycloakto a version that resolves this vulnerability.Fixed in 23.0.4
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6927?
CVE-2023-6927 has been classified as a high severity vulnerability.
How do I fix CVE-2023-6927?
To fix CVE-2023-6927, you should upgrade Keycloak to version 23.0.4 or later.
Which versions of Keycloak are affected by CVE-2023-6927?
Keycloak versions prior to 23.0.4, including 23.0.3 and earlier versions, are affected by CVE-2023-6927.
What type of vulnerability is CVE-2023-6927?
CVE-2023-6927 is a vulnerability that may allow an attacker to steal authorization codes or tokens.
Is there a patch available for CVE-2023-6927?
Yes, a patch is available in Keycloak version 23.0.4 to address CVE-2023-6927.