CVE-2023-6927: Keycloak Open Redirect vulnerability in org.keycloak:keycloak-parent
Summary
CVE-2023-6927: Duplicate Advisory: Keycloak Open Redirect vulnerability. Affects org.keycloak:keycloak-parent versions < 23.0.3. No fix is published. How to fix ↓
Also tracked for
- org.keycloak:keycloak-core · Maven
The same CVE-2023-6927 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, social login, and user federation. The org.keycloak:keycloak-parent package is a Maven project that serves as the parent project for Keycloak. It contains common configurations and dependencies used by Keycloak modules. This package is vulnerable to an Open Redirect vulnerability.
Vulnerability Detail
The Open Redirect vulnerability in Keycloak allows an attacker to steal authorization codes or tokens from clients. This vulnerability arises from the use of a wildcard in the JARM response mode "form_post.jwt". By exploiting this vulnerability, an attacker can bypass the security patch implemented to address CVE-2023-6134. The impact of this vulnerability can lead to unauthorized access to sensitive information and potential account compromise.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the org.keycloak:keycloak-parent package to a secure version.
Conclusion
The Keycloak Open Redirect vulnerability in the org.keycloak:keycloak-parent package can lead to unauthorized access and potential account compromise. It is crucial to apply the recommended fix by upgrading to a secure version of the package. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-parent →
FAQ
Keycloak is an open-source identity and access management solution that provides features such as single sign-on, social login, and user federation.
The org.keycloak:keycloak-parent package is a Maven project that serves as the parent project for Keycloak. It contains common configurations and dependencies used by Keycloak modules.
An Open Redirect vulnerability allows an attacker to redirect users to a malicious website by manipulating a legitimate URL. This can lead to phishing attacks and the theft of sensitive information.
CVE-2023-6134 is a security vulnerability that was previously identified and patched in Keycloak. The Open Redirect vulnerability described here can bypass the security patch implemented for CVE-2023-6134.
To fix this vulnerability, you need to upgrade the org.keycloak:keycloak-parent package to version 23.0.4 or later. Update the package in your project's Maven configuration file (pom.xml) and rebuild your application.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-parent.
