CVE-2023-6484: Keycloak: log injection during webauthn authentication or registration

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-25 · updated 2026-06-26
Weakness: CWE-117

Description

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

Affected products

Red Hat build of Keycloak 22: all versions — fixed in 22-13, 22-16, 22.0.10-1
Red Hat Single Sign-On 7.6 for RHEL 7: all versions — fixed in 0:18.0.12-1.redhat_00001.1.el7sso, 0:18.0.13-1.redhat_00001.1.el7sso
Red Hat Single Sign-On 7.6 for RHEL 8: all versions — fixed in 0:18.0.12-1.redhat_00001.1.el8sso, 0:18.0.13-1.redhat_00001.1.el8sso
Red Hat Single Sign-On 7.6 for RHEL 9: all versions — fixed in 0:18.0.12-1.redhat_00001.1.el9sso, 0:18.0.13-1.redhat_00001.1.el9sso
Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.6-16, 7.6-18, 7.6-41, 7.6-46, 7.6.8-2

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 22 22-13, 22-16, 22.0.10-1; Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.12-1.redhat_00001.1.el7sso, 0:18.0.13-1.redhat_00001.1.el7sso; Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.12-1.redhat_00001.1.el8sso, 0:18.0.13-1.redhat_00001.1.el8sso; Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.12-1.redhat_00001.1.el9sso, 0:18.0.13-1.redhat_00001.1.el9sso; Red Hat RHEL-8 based Middleware Containers 7.6-16, 7.6-18, 7.6-41, 7.6-46. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6484 or the next vulnerability affects your stack