VDB
Sign up
MEDIUM4.6

GHSA-9vm7-v8wj-3fqw

keycloak-core: open redirect via "form_post.jwt" JARM response mode

Quick fix

GHSA-9vm7-v8wj-3fqw — org.keycloak:keycloak-core: upgrade to the fixed version with the command below.

# pom.xml: bump <version>23.0.4</version> for org.keycloak:keycloak-core

Details

An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". It is observed that changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/org.keycloak:keycloak-core
Introduced in: 0Fixed in: 23.0.4
Fix# pom.xml: bump <version>23.0.4</version> for org.keycloak:keycloak-core

References