CVE-2023-0091: Keycloak Lack of Validation of Access Token on Client Registrations Endpoint
Summary
CVE-2023-0091: Keycloak has lack of validation of access token on client registrations endpoint. Affects org.keycloak:keycloak-core versions < 20.0.3. Fixed in 20.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications. The 'keycloak-core' package is a core component of Keycloak that handles client registrations and management. It is commonly used in Maven projects.
Vulnerability Detail
The vulnerability in Keycloak's 'keycloak-core' package allows a service account with the 'create-client' or 'manage-clients' role to create or manage clients using an access token. However, the access token is not properly validated in the client registration endpoints. If the access token is leaked, an attacker could use it to create or manage clients without proper authorization. Although there is an option to revoke the specific token, this check is not performed in the client registration endpoints.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
20.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the 'keycloak-core' package.
Conclusion
The lack of validation of access tokens on the client registrations endpoint in Keycloak's 'keycloak-core' package can lead to unauthorized creation or management of clients. It is crucial to upgrade to the fixed version of the package (20.0.3 or later) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides authentication and authorization services for applications.
The 'keycloak-core' package is a core component of Keycloak that handles client registrations and management. It is commonly used in Maven projects.
This vulnerability allows unauthorized creation or management of clients using leaked access tokens, potentially compromising the security and integrity of the Keycloak system.
To fix this vulnerability, it is recommended to upgrade the 'keycloak-core' package to version 20.0.3 or later.
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of the 'keycloak-core' package.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
