~ / search / GHSA-46c8-635v-68r2

GHSA-46c8-635v-68r2

Keycloak Authorization Bypass vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-6544

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 22.0.10 22.0.10
Maven org.keycloak:keycloak-services >= 23.0.0, < 24.0.3 24.0.3

Details

As written in the advisory (Markdown source, shown as plain text).

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized. #### Acknowledgements: Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.

References

External links from the advisory. They lead to third-party sites.