GHSA-7fpj-9hr8-28vh

    Dashboard / Vulnerabilities / GHSA-7fpj-9hr8-28vh

    GHSA-7fpj-9hr8-28vh

    Published: 17 Apr 2024Last Modified: 10 Sept 2026
    Aliases:
    CVE-2023-0657

    Summary: Keycloak vulnerable to impersonation via logout token exchange

    Details: Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

    References: https://github.com/keycloak/keycloak/security/advisories/GHSA-7fpj-9hr8-28vh, https://nvd.nist.gov/vuln/detail/CVE-2023-0657, https://access.redhat.com/errata/RHSA-2024:1867, https://access.redhat.com/errata/RHSA-2024:1868, https://access.redhat.com/security/cve/CVE-2023-0657, https://bugzilla.redhat.com/show_bug.cgi?id=2166728, https://github.com/keycloak/keycloak

    Affected packages

    Package

    Name: org.keycloak:keycloak-services

    Purl: pkg:maven/org.keycloak/keycloak-services

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -22.0.10

    Affected versions

    1.0-alpha-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-7fpj-9hr8-28vh | CVE-DB