Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2023:3883 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:3884 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:3885 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:3888 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:3892 | Vendor Advisory |
https://access.redhat.com/security/cve/CVE-2023-2585 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2196335 | Issue Tracking Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2023-12-21T09:24:16.632Z
Updated: 2024-05-03T15:32:35.422Z
Reserved: 2023-05-08T19:39:58.370Z
Link: CVE-2023-2585
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-12-21T10:15:34.533
Modified: 2024-01-02T18:28:16.777
Link: CVE-2023-2585
JSON object: View
Redhat Information
No data.
CWE