GHSA-v436-q368-hvgg
Keycloak has lack of validation of access token on client registrations endpoint
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-core | < 20.0.3 | 20.0.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.
If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.
References
External links from the advisory. They lead to third-party sites.