REDHAT-BUG-2196335: Low severity keycloak vulnerability

Published May 8, 2023

Updated

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authed admin into granting consent to a malicious OAuth client, or possible unauthorized access to an existing OAuth client.

Affected Software

1 affected component

Red Hat Keycloak

Event History

May 8, 2023

Data Sourced

via Red Hat·07:41 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2196335?

The severity of REDHAT-BUG-2196335 is critical due to the potential for unauthorized access and client spoofing.

How do I fix REDHAT-BUG-2196335?

To fix REDHAT-BUG-2196335, update your Red Hat Build of Keycloak to the latest patched version provided by Red Hat.

What causes the vulnerability in REDHAT-BUG-2196335?

The vulnerability in REDHAT-BUG-2196335 is caused by Keycloak's failure to properly validate the device code and client ID.

Who is affected by REDHAT-BUG-2196335?

Users of Red Hat Build of Keycloak are affected by REDHAT-BUG-2196335, particularly those utilizing device authorization grants.

What can an attacker do with REDHAT-BUG-2196335?

An attacker exploiting REDHAT-BUG-2196335 could potentially spoof authorization requests and trick administrators into granting consent to malicious OAuth clients.