What’s Vulnerable › Vulnerabilities

CVE-2023-2422: Keycloak: oauth client impersonation

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-04 · updated 2026-06-17
• Weakness: CWE-295

Description

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.

Affected products

• Keycloak: all versions
• Red Hat OpenShift Container Platform 4.18: 4.9, 4.10, 4.11, 4.12
• Red Hat Single Sign-On: 7.6

References

• https://access.redhat.com/errata/RHSA-2023:3883
• https://access.redhat.com/errata/RHSA-2023:3884
• https://access.redhat.com/errata/RHSA-2023:3885
• https://access.redhat.com/errata/RHSA-2023:3888
• https://access.redhat.com/errata/RHSA-2023:3892
• https://access.redhat.com/security/cve/CVE-2023-2422
• https://bugzilla.redhat.com/show_bug.cgi?id=2191668
• https://access.redhat.com/errata/RHSA-2023:3883
• https://access.redhat.com/errata/RHSA-2023:3884
• https://access.redhat.com/errata/RHSA-2023:3885
• https://access.redhat.com/errata/RHSA-2023:3888
• https://access.redhat.com/errata/RHSA-2023:3892

Get alerted when CVE-2023-2422 or the next vulnerability affects your stack