← Back

CVE-2023-0264

nvd nist
Published: Aug 4, 2023Modified: Jun 17, 2026

JSON object

Loading...
5.0
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Exploitability: 1.6 / Impact: 3.4
Source: NVD

Description

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Affected (9)

Redhat
5 products
Keycloak
Openshift Container Platform
Openshift Container Platform For Ibm Linuxone
Openshift Container Platform Ibm Z Systems
Single Sign On
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Keycloak
Before 18.0.6
Configuration B
2 platform
Running on/withPlatform Versions
Redhat
Enterprise Linux
Version 7.0
Redhat
Enterprise Linux
Version 9.0
Configuration C
7 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Redhat
Openshift Container Platform
Version 4.10
Openshift Container Platform
Version 4.9
Redhat
Openshift Container Platform For Ibm Linuxone
Version 4.10
Openshift Container Platform For Ibm Linuxone
Version 4.9
Redhat
Openshift Container Platform Ibm Z Systems
Version 4.10
Openshift Container Platform Ibm Z Systems
Version 4.9
Single Sign On
Before 7.6.2
Running on/withPlatform Versions
Redhat
Enterprise Linux
Version 8.0
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Single Sign On
All versions

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

Source: secalert@redhat.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.