Lucene search

GitHub Advisory DatabaseGHSA-7FPJ-9HR8-28VH

HistoryApr 17, 2024 - 6:25 p.m.

Keycloak vulnerable to impersonation via logout token exchange

2024-04-1718:25:59

CWE-284

CWE-287

CWE-290

CWE-347

GitHub Advisory Database

github.com

keycloak

vulnerability

impersonation

logout token

access token

data security

AI Score

6.8

Confidence

High

JSON

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

Affected configurations

Vulners

Node

org.keycloakkeycloak-servicesRange23.0.0–24.0.3

org.keycloakkeycloak-servicesRange<22.0.10

VendorProductVersionCPE
org.keycloakkeycloak-services*cpe:2.3:a:org.keycloak:keycloak-services:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
org.keycloak	keycloak-services	*	cpe:2.3:a:org.keycloak:keycloak-services::::::::

References

github.com/advisories/GHSA-7fpj-9hr8-28vh

github.com/keycloak/keycloak/security/advisories/GHSA-7fpj-9hr8-28vh

AI Score

6.8

Confidence

High

JSON

Related for GHSA-7FPJ-9HR8-28VH