CVE-2023-0657

Description

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

Reserved 2023-02-02 | Published 2024-11-17 | Updated 2024-11-17 | Assigner redhat

Problem types

Improper Check for Dropped Privileges

Product status

Default status
unaffected

Any version before 22.0.10
affected

23.0.0 before 24.0.3
affected

Default status
affected

22.0.10-1 before *
unaffected

Default status
affected

22-13 before *
unaffected

Default status
affected

22-16 before *
unaffected

Default status
unaffected

Default status
affected

Timeline

2023-02-02:	Reported to Red Hat.
2024-04-16:	Made public.

References

access.redhat.com/errata/RHSA-2024:1867 (RHSA-2024:1867) vendor-advisory

access.redhat.com/errata/RHSA-2024:1868 (RHSA-2024:1868) vendor-advisory

access.redhat.com/security/cve/CVE-2023-0657 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2166728 (RHBZ#2166728) issue-tracking

cve.org (CVE-2023-0657)

nvd.nist.gov (CVE-2023-0657)

Download JSON