~ / search / GHSA-f5h4-wmp5-xhg6

GHSA-f5h4-wmp5-xhg6

Client Spoofing within the Keycloak Device Authorisation Grant

Source: GitHub Advisory Database (reviewed) Low CVE-2023-2585

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 21.1.2 21.1.2
Maven org.keycloak:keycloak-server-spi-private < 21.1.2 21.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.

References

External links from the advisory. They lead to third-party sites.