CVE-2023-0264
Keycloak vulnerable to user impersonation via stolen UUID code
Summary
Keycloak vulnerable to user impersonation via stolen UUID code
Original description
The description as published by the source.
Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Maven
org.keycloak:keycloak-services
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.0.1"}]}]
References
- advisory nvd.nist.gov
- package github.com
- web github.com
- web github.com
- web access.redhat.com