Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

2024-06-1018:36:56

CWE-922

GitHub Advisory Database

github.com

keycloak

par

vulnerability

sensitive information

kc_restart

information disclosure

http response

authorization server

6.6 Medium

AI Score

Confidence

Low

JSON

A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server’s HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.

Affected configurations

Vulners

Node

org.keycloak\keycloakMatchservices

CPENameOperatorVersion
org.keycloak:keycloak-serviceslt24.0.5

CPE	Name	Operator	Version
	org.keycloak:keycloak-services	lt	24.0.5

References

github.com/advisories/GHSA-69fp-7c8p-crjr

github.com/keycloak/keycloak/commit/2191cc26ae6deb52eeaf74046027b65804d16fd0

github.com/keycloak/keycloak/security/advisories/GHSA-69fp-7c8p-crjr

6.6 Medium

AI Score

Confidence

Low

JSON