What’s Vulnerable › Vulnerabilities
CVE-2023-2585: Keycloak: client access via device auth request spoof
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-12-21 · updated 2026-06-17
- Weakness: CWE-358
Description
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Affected products
- Red Hat OpenShift Container Platform 4.18: 4.11, 4.12
- RedHat Openshift Container Platform For Ibm Z: 4.9, 4.10
- RedHat Openshift Container Platform For Linuxone: 4.9, 4.10
- RedHat Openshift Container Platform For Power: 4.9, 4.10
- Red Hat Single Sign-On: 7.6
References
- https://access.redhat.com/errata/RHSA-2023:3883
- https://access.redhat.com/errata/RHSA-2023:3884
- https://access.redhat.com/errata/RHSA-2023:3885
- https://access.redhat.com/errata/RHSA-2023:3888
- https://access.redhat.com/errata/RHSA-2023:3892
- https://access.redhat.com/security/cve/CVE-2023-2585
- https://bugzilla.redhat.com/show_bug.cgi?id=2196335
- https://access.redhat.com/errata/RHSA-2023:3883
- https://access.redhat.com/errata/RHSA-2023:3884
- https://access.redhat.com/errata/RHSA-2023:3885
- https://access.redhat.com/errata/RHSA-2023:3888
- https://access.redhat.com/errata/RHSA-2023:3892
Get alerted when CVE-2023-2585 or the next vulnerability affects your stack