REDHAT-BUG-2547957: Medium severity Red Hat Keycloak vulnerability
A flaw was found in the keycloak-services component. A copy-paste error in the OIDC Dynamic Client Registration response serialization prevents the backchannellogoutrevokeofflinetokens setting from being included in GET responses. When an authorized user or client performs a standard read-modify-write update (GET followed by PUT), the missing field is interpreted as false, silently disabling the revocation of offline tokens. An attacker with manage-clients or registration access can exploit this to ensure offline tokens survive backchannel logout events, maintaining unauthorized access after a session should have been terminated. Additionally, this bug causes the backchannellogoutsessionrequired status to be incorrectly overwritten.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the affected update behavior?
An authorized user or client with manage-clients or registration access can trigger it by performing a standard read-modify-write operation: GET the client configuration and then PUT an update.
What is the security impact of the missing setting during an update?
The omitted backchannel_logout_revoke_offline_tokens field is treated as false during the PUT request. This disables offline-token revocation on backchannel logout, allowing offline tokens to remain usable after the related session should have been terminated.
Are any other client logout settings changed unexpectedly?
Yes. The backchannel_logout_session_required status is also incorrectly overwritten.