cbcvebase.
CVE-2023-2422
published 2023-10-04

CVE-2023-2422: A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client…

high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.

Affected

5 ranges
VendorProductVersion rangeFixed in
redhatopenshift_container_platform——
redhatopenshift_container_platform——
redhatopenshift_container_platform——
redhatopenshift_container_platform——
redhatsingle_sign-on——