Open Redirect Affecting org.keycloak:keycloak-services package, versions [,23.0.4)
Threat Intelligence
EPSS
0.15% (52nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-6132135
- published 20 Dec 2023
- disclosed 19 Dec 2023
- credit Pontus Hanssen
Introduced: 19 Dec 2023
CVE-2023-6927 Open this link in a new tabHow to fix?
Upgrade org.keycloak:keycloak-services to version 23.0.4 or higher.
Overview
org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.
Affected versions of this package are vulnerable to Open Redirect due to improper validation of redirect URIs using the form_post.jwt response mode. An attacker can redirect a user to a malicious site and potentially steal authorization codes or tokens by exploiting the use of a wildcard in the JARM response.
CVSS Scores
version 3.1