~ / search / GHSA-69fp-7c8p-crjr

GHSA-69fp-7c8p-crjr

Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

Source: GitHub Advisory Database (reviewed) High CVE-2024-4540

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 24.0.5 24.0.5

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.

References

External links from the advisory. They lead to third-party sites.