CVE-2023-6291

Description

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

Reserved 2023-11-24 | Published 2024-01-26 | Updated 2025-04-04 | Assigner redhat

Problem types

URL Redirection to Untrusted Site ('Open Redirect')

Product status

Default status
affected

22.0.7-1 before *
unaffected

Default status
affected

22-6 before *
unaffected

Default status
affected

22-9 before *
unaffected

Default status
unaffected

Default status
unaffected

Default status
affected

0:18.0.11-2.redhat_00003.1.el7sso before *
unaffected

Default status
affected

0:18.0.12-1.redhat_00001.1.el7sso before *
unaffected

Default status
affected

0:18.0.11-2.redhat_00003.1.el8sso before *
unaffected

Default status
affected

0:18.0.12-1.redhat_00001.1.el8sso before *
unaffected

Default status
affected

0:18.0.11-2.redhat_00003.1.el9sso before *
unaffected

Default status
affected

0:18.0.12-1.redhat_00001.1.el9sso before *
unaffected

Default status
affected

7.6-38 before *
unaffected

Default status
affected

7.6.6-2 before *
unaffected

Default status
affected

7.6-41 before *
unaffected

Default status
unaffected

Default status
affected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Default status
unaffected

Timeline

2023-11-24:	Reported to Red Hat.
2023-12-14:	Made public.

References

access.redhat.com/errata/RHSA-2023:7854 (RHSA-2023:7854) vendor-advisory

access.redhat.com/errata/RHSA-2023:7855 (RHSA-2023:7855) vendor-advisory

access.redhat.com/errata/RHSA-2023:7856 (RHSA-2023:7856) vendor-advisory

access.redhat.com/errata/RHSA-2023:7857 (RHSA-2023:7857) vendor-advisory

access.redhat.com/errata/RHSA-2023:7858 (RHSA-2023:7858) vendor-advisory

access.redhat.com/errata/RHSA-2023:7860 (RHSA-2023:7860) vendor-advisory

access.redhat.com/errata/RHSA-2023:7861 (RHSA-2023:7861) vendor-advisory

access.redhat.com/errata/RHSA-2024:0798 (RHSA-2024:0798) vendor-advisory

access.redhat.com/errata/RHSA-2024:0799 (RHSA-2024:0799) vendor-advisory

access.redhat.com/errata/RHSA-2024:0800 (RHSA-2024:0800) vendor-advisory

access.redhat.com/errata/RHSA-2024:0801 (RHSA-2024:0801) vendor-advisory

access.redhat.com/errata/RHSA-2024:0804 (RHSA-2024:0804) vendor-advisory

access.redhat.com/security/cve/CVE-2023-6291 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2251407 (RHBZ#2251407) issue-tracking

cve.org (CVE-2023-6291)

nvd.nist.gov (CVE-2023-6291)

Download JSON