REDHAT-BUG-2549478: Medium severity Red Hat Keycloak vulnerability
A flaw was found in Keycloaks implementation of the Client-Initiated Backchannel Authentication CIBA grant. Although the CIBA specification and Keycloaks internal contract intend for this flow to be restricted to confidential clients, the enforcement mechanism is missing at both the backchannel-authentication and token endpoints. While bearer-only clients are correctly rejected, public clients which authenticate using only a client-id are permitted to proceed. An attacker can exploit this by using a public client to initiate a CIBA flow for a known user via login-hint. If the targeted user approves the resulting push notification on their authentication device, the attacker can redeem the auth-req-id at the token endpoint to obtain a valid user access token. This allows the attacker to perform any action the user is authorized to do and access their private information, all without ever possessing a client secret or valid credentials.
Affected Software
Event History
Frequently Asked Questions
Which client types are affected by the missing CIBA restriction?
Public clients that authenticate using only a client ID are permitted to use the CIBA flow. Bearer-only clients are correctly rejected; the intended restriction is to confidential clients.
What does an attacker need to exploit this issue?
The attacker needs a public client and a known target user identified through login-hint. The targeted user must approve the push notification on their authentication device before the attacker can redeem the auth-req-id.
What is the impact if exploitation succeeds?
The attacker can obtain a valid access token for the targeted user without possessing a client secret or valid user credentials. They can then perform actions authorized for that user and access the user's private information.