Lucene search

K
veracodeVeracode Vulnerability DatabaseVERACODE:38875
HistoryJan 16, 2023 - 3:38 p.m.

Insecure Token Validation

2023-01-1615:38:37
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
12
token validation
vulnerable
clientregistrationtokenutils
client credential flow
revocations
sensitive information
client-registration endpoints

EPSS

0.001

Percentile

22.6%

keycloak-services is vulnerable to Insecure Token validation. The vulnerability exists because the verifyToken function in ClientRegistrationTokenUtils.java does not properly validate the client tokens for possible revocations in its client credential flow, allowing an attacker to access or modify potentially sensitive information through the client-registration endpoints.

EPSS

0.001

Percentile

22.6%