VYPR
← All advisories
Low severity3.5NVD Advisory· Published Dec 21, 2023· Updated Jun 17, 2026

CVE-2023-2585

CVE-2023-2585

Description

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-servicesMaven
< 21.1.221.1.2
org.keycloak:keycloak-server-spi-privateMaven
< 21.1.221.1.2

Affected products

17
  • Red Hat/Single Sign Oncpe-rescue6 versions
    cpe:/a:redhat:red_hat_single_sign_on:7.6.4+ 5 more
    • cpe:/a:redhat:red_hat_single_sign_on:7.6.4
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el7range: 0:18.0.8-1.redhat_00001.1.el7sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el8range: 0:18.0.8-1.redhat_00001.1.el8sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el9range: 0:18.0.8-1.redhat_00001.1.el9sso
    • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
    • cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*
  • Red Hat/RHEL-8 based Middleware Containersv5
    cpe:/a:redhat:rhosemc:1.0::el8
    Range: 7.6-24
  • Red Hat/Openshift Container Platform4 versions
    cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform For Ibm Z2 versions
    cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform For Linuxone2 versions
    cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
  • ghsa-coords2 versions
    pkg:maven/org.keycloak/keycloak-server-spi-privatepkg:maven/org.keycloak/keycloak-services
    < 21.1.2+ 1 more
    • (no CPE)range: < 21.1.2
    • (no CPE)range: < 21.1.2

Patches

Vulnerability mechanics

References

11

News mentions

0

No linked articles in our index yet.