CVE-2024-4540: Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-03 · updated 2026-10-09
Weakness: CWE-312

Description

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.

Affected products

Red Hat build of Keycloak 26.4: all versions — fixed in 24-10, 24.0.5-2
Red Hat build of Keycloak 22: all versions — fixed in 22-15, 22-18, 22.0.11-2
Red Hat Single Sign-On 7.6 for RHEL 7: all versions — fixed in 0:18.0.14-1.redhat_00001.1.el7sso
Red Hat Single Sign-On 7.6 for RHEL 8: all versions — fixed in 0:18.0.14-1.redhat_00001.1.el8sso
Red Hat Single Sign-On 7.6 for RHEL 9: all versions — fixed in 0:18.0.14-1.redhat_00001.1.el9sso
Red Hat RHEL-8 based Middleware Containers: all versions — fixed in 7.6-49

How to fix

Upgrade to a fixed version: Red Hat build of Keycloak 26.4 24-10, 24.0.5-2; Red Hat build of Keycloak 22 22-15, 22-18, 22.0.11-2; Red Hat Single Sign-On 7.6 for RHEL 7 0:18.0.14-1.redhat_00001.1.el7sso; Red Hat Single Sign-On 7.6 for RHEL 8 0:18.0.14-1.redhat_00001.1.el8sso; Red Hat Single Sign-On 7.6 for RHEL 9 0:18.0.14-1.redhat_00001.1.el9sso; Red Hat RHEL-8 based Middleware Containers 7.6-49. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-4540 or the next vulnerability affects your stack