CVE-2023-6291

    Dashboard / Vulnerabilities / CVE-2023-6291

    CVE-2023-6291

    Published: 26 Jan 2024Last Modified: 23 Sept 2026

    Summary: Keycloak: redirect_uri validation bypass

    Details: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

    References: https://access.redhat.com/downloads/content/package-browser/, https://access.redhat.com/jbossnetwork/restricted/listSoftware.html, https://catalog.redhat.com/software/containers/, https://access.redhat.com/errata/RHSA-2023:7854, https://access.redhat.com/errata/RHSA-2023:7855, https://access.redhat.com/errata/RHSA-2023:7856, https://access.redhat.com/errata/RHSA-2023:7857, https://access.redhat.com/errata/RHSA-2023:7858, https://access.redhat.com/errata/RHSA-2023:7860, https://access.redhat.com/errata/RHSA-2023:7861, https://access.redhat.com/errata/RHSA-2024:0798, https://access.redhat.com/errata/RHSA-2024:0799, https://access.redhat.com/errata/RHSA-2024:0800, https://access.redhat.com/errata/RHSA-2024:0801, https://access.redhat.com/errata/RHSA-2024:0804, https://access.redhat.com/security/cve/CVE-2023-6291, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6291.json, https://nvd.nist.gov/vuln/detail/CVE-2023-6291, https://bugzilla.redhat.com/show_bug.cgi?id=2251407

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -0ccd72b0b06a6d30c17a8f951860be3d6de9dabf

    Affected versions

    2.4.0.Test

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-6291 | CVE-DB