CVE-2023-6291
—CVSS 3.1
7.1 high
EPSS
<1%p59
Published
()
Modified
Description
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
- Vendors
- redhat
- Products
- keycloak, single sign-on, openshift container platform, openshift container platform for ibm z, openshift container platform for linuxone, openshift container platform for power, migration toolkit for applications
- Weakness
- CWE-601
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
In the news0 stories
No ingested article mentions this CVE yet.