CVE-2023-6927
published 2023-12-18CVE-2023-6927: A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode…
PriorityP432medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.11%
62.0th percentile
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | single_sign-on | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
ghsa5.4MEDIUM
osv5.4MEDIUM
vendor_redhat4.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
keycloak: open redirect via "form_post.jwt" JARM response mode
vendor_redhat·2023-12-18·CVSS 4.6
CVE-2023-6927 [MEDIUM] CWE-601 keycloak: open redirect via "form_post.jwt" JARM response mode
keycloak: open redirect via "form_post.jwt" JARM response mode
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.
Statement: Red Hat rates this as a moderate, following the same case for CVE-2023-6134, but with another response mode with JSON Web Token.
Mitigation: Mitigation for this issue is either not available or the cu
Red Hat
keycloak-core: Reflected XSS via wildcard in OIDC redirect_uri. Incomplete fix of CVE-2023-6134
vendor_redhat·2023-12-18·CVSS 4.6
CVE-2023-6920 [MEDIUM] CWE-75 keycloak-core: Reflected XSS via wildcard in OIDC redirect_uri. Incomplete fix of CVE-2023-6134
keycloak-core: Reflected XSS via wildcard in OIDC redirect_uri. Incomplete fix of CVE-2023-6134
An incomplete fix was found in the Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". Changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.
Statement: This flaw was found to be a duplicate of CVE-2023-6927. Please see https://access.redhat.com/security/cve/CVE-2023-6927 for information about affected products and security errata.
Mitigation: No current mitigation is available for this flaw.
Package: keycloak-core (Red Hat Build of Keycloak) - Affected
Package: rh-sso7-keycloak (R
GHSA
keycloak-core: open redirect via "form_post.jwt" JARM response mode
ghsa·2024-01-23·CVSS 5.4
CVE-2023-6927 [MEDIUM] CWE-601 keycloak-core: open redirect via "form_post.jwt" JARM response mode
keycloak-core: open redirect via "form_post.jwt" JARM response mode
An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". It is observed that changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.
OSV
keycloak-core: open redirect via "form_post.jwt" JARM response mode
osv·2024-01-23·CVSS 5.4
CVE-2023-6927 [MEDIUM] keycloak-core: open redirect via "form_post.jwt" JARM response mode
keycloak-core: open redirect via "form_post.jwt" JARM response mode
An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt". It is observed that changing the response_mode parameter in the original proof of concept from "form_post" to "form_post.jwt" can bypass the security patch implemented to address CVE-2023-6134.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/errata/RHSA-2024:0094https://access.redhat.com/errata/RHSA-2024:0095https://access.redhat.com/errata/RHSA-2024:0096https://access.redhat.com/errata/RHSA-2024:0097https://access.redhat.com/errata/RHSA-2024:0098https://access.redhat.com/errata/RHSA-2024:0100https://access.redhat.com/errata/RHSA-2024:0101https://access.redhat.com/errata/RHSA-2024:0798https://access.redhat.com/errata/RHSA-2024:0799https://access.redhat.com/errata/RHSA-2024:0800https://access.redhat.com/errata/RHSA-2024:0801https://access.redhat.com/errata/RHSA-2024:0804https://access.redhat.com/security/cve/CVE-2023-6927https://bugzilla.redhat.com/show_bug.cgi?id=2255027https://access.redhat.com/errata/RHSA-2024:0094https://access.redhat.com/errata/RHSA-2024:0095https://access.redhat.com/errata/RHSA-2024:0096https://access.redhat.com/errata/RHSA-2024:0097https://access.redhat.com/errata/RHSA-2024:0098https://access.redhat.com/errata/RHSA-2024:0100https://access.redhat.com/errata/RHSA-2024:0101https://access.redhat.com/errata/RHSA-2024:0798https://access.redhat.com/errata/RHSA-2024:0799https://access.redhat.com/errata/RHSA-2024:0800https://access.redhat.com/errata/RHSA-2024:0801https://access.redhat.com/errata/RHSA-2024:0804https://access.redhat.com/security/cve/CVE-2023-6927https://bugzilla.redhat.com/show_bug.cgi?id=2255027
2023-12-18
Published