CVE-2023-0264

MEDIUM 5.0EPSS 1.3%

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Affected: redhat.com · Keycloak
CVSS v3.1 NVD: 5.0 MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v3.1 GitHub: 8.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
EPSS: 1.27% chance of exploitation in the next 30 days, 69th percentile
Published: 2023-08-04
Updated: 2024-08-02

Proof-of-concept exploits (1)

twwd/CVE-2023-02647★ · 2023-03-06

Security advisories

https://access.redhat.com/security/cve/CVE-2023-0264
advisories/GHSA-9g98-5mj6-f9mv

References

CVE Record
NVD entry