Vulnerability Database
289,571
Total vulnerabilities in the database
CVE-2023-6291
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.
| Software | From | Fixed in |
|---|---|---|
org.keycloak / keycloak-services
|
- | 23.0.3 |
| redhat / keycloak | - | 22.0.7 |
| redhat / openshift_container_platform | 4.11 | 4.11.x |
| redhat / openshift_container_platform | 4.12 | 4.12.x |
| redhat / openshift_container_platform_for_ibm_z | 4.9 | 4.9.x |
| redhat / openshift_container_platform_for_ibm_z | 4.10 | 4.10.x |
| redhat / openshift_container_platform_for_linuxone | 4.9 | 4.9.x |
| redhat / openshift_container_platform_for_linuxone | 4.10 | 4.10.x |
| redhat / openshift_container_platform_for_power | 4.9 | 4.9.x |
| redhat / openshift_container_platform_for_power | 4.10 | 4.10.x |
| redhat / single_sign-on | 7.6 | 7.6.x |
| redhat / migration_toolkit_for_applications | 6.0 | 6.0.x |
| redhat / migration_toolkit_for_applications | 7.0 | 7.0.x |
- https://access.redhat.com/errata/RHSA-2023:7854
- https://access.redhat.com/errata/RHSA-2023:7855
- https://access.redhat.com/errata/RHSA-2023:7856
- https://access.redhat.com/errata/RHSA-2023:7857
- https://access.redhat.com/errata/RHSA-2023:7858
- https://access.redhat.com/errata/RHSA-2023:7860
- https://access.redhat.com/errata/RHSA-2023:7861
- https://access.redhat.com/errata/RHSA-2024:0798
- https://access.redhat.com/errata/RHSA-2024:0799
- https://access.redhat.com/errata/RHSA-2024:0800
- https://access.redhat.com/errata/RHSA-2024:0801
- https://access.redhat.com/errata/RHSA-2024:0804
- https://access.redhat.com/security/cve/CVE-2023-6291
- https://bugzilla.redhat.com/show_bug.cgi?id=2251407
- https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b
- https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w