Open Redirect Affecting org.keycloak:keycloak-common package, versions [,23.0.4)
Threat Intelligence
EPSS
0.15% (52nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGKEYCLOAK-6230634
- published 7 Feb 2024
- disclosed 19 Dec 2023
- credit Pontus Hanssen
Introduced: 19 Dec 2023
CVE-2023-6927 Open this link in a new tabHow to fix?
Upgrade org.keycloak:keycloak-common to version 23.0.4 or higher.
Overview
org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.
Affected versions of this package are vulnerable to Open Redirect due to improper validation of redirect URIs using the form_post.jwt response mode. An attacker can redirect a user to a malicious site and potentially steal authorization codes or tokens by exploiting the use of a wildcard in the JARM response.
CVSS Scores
version 3.1