CVE-2023-6134
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.
| Software | From | Fixed in |
|---|---|---|
org.keycloak / keycloak-services
|
- | 23.0.3 |
| redhat / keycloak | - | 22.0.7 |
| redhat / single_sign-on | - | 7.6 |
| redhat / openshift_container_platform | 4.11 | 4.11.x |
| redhat / openshift_container_platform | 4.12 | 4.12.x |
| redhat / openshift_container_platform_for_power | 4.9 | 4.9.x |
| redhat / openshift_container_platform_for_power | 4.10 | 4.10.x |
| redhat / openshift_container_platform_ibm_z_systems | 4.9 | 4.9.x |
| redhat / openshift_container_platform_ibm_z_systems | 4.10 | 4.10.x |
- https://access.redhat.com/errata/RHSA-2023:7854
- https://access.redhat.com/errata/RHSA-2023:7855
- https://access.redhat.com/errata/RHSA-2023:7856
- https://access.redhat.com/errata/RHSA-2023:7857
- https://access.redhat.com/errata/RHSA-2023:7858
- https://access.redhat.com/errata/RHSA-2023:7860
- https://access.redhat.com/errata/RHSA-2023:7861
- https://access.redhat.com/errata/RHSA-2024:0798
- https://access.redhat.com/errata/RHSA-2024:0799
- https://access.redhat.com/errata/RHSA-2024:0800
- https://access.redhat.com/errata/RHSA-2024:0801
- https://access.redhat.com/errata/RHSA-2024:0804
- https://access.redhat.com/security/cve/CVE-2023-6134
- https://bugzilla.redhat.com/show_bug.cgi?id=2249673
- https://github.com/keycloak/keycloak/commit/15a21bf8e4fb71f006ba9caf25b9c9d1d152cd20
- https://github.com/keycloak/keycloak/security/advisories/GHSA-cvg2-7c3j-g36j
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime