REDHAT-BUG-2569299: Code Injection
A flaw was found in the org.keycloak.services package of Keycloak. When an authentication flow is initiated through the login-actions/reset-credentials entry point, the resulting authorization session fails to evaluate and apply client-level mandatory PKCE settings. If a user subsequently navigates back to the standard login form and completes authentication, Keycloak issues an authorization code that lacks associated code challenge metadata. Because the token endpoint validates PKCE based on the presence of metadata in the code rather than the client configuration, the code can be redeemed for tokens without a codeverifier. An attacker who intercepts this authorization code can perform a code injection attack to obtain access and refresh tokens, allowing them to impersonate the victim and access or modify protected data.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments are exposed when a client has mandatory PKCE settings and an authentication flow can be initiated through the login-actions/reset-credentials entry point before the user returns to the standard login form and authenticates.
What does an attacker need to exploit it?
The attacker must intercept an authorization code issued through the affected flow. They can then redeem that code without a code_verifier and obtain access and refresh tokens.
What is the impact if exploitation succeeds?
An attacker can impersonate the victim using the obtained tokens and access or modify protected data.