Red Hat Security Advisory

RHSA-2023:7860

Red Hat build of Keycloak 22.0.7 enhancement and security update

Released 2023-12-14 · Red Hat rating Important · View on Red Hat →

Fixed in

TI-2023-05774 CVE-2023-6291 · GHSA-mpwq-j3xf-7m5w

LOW 33

A flaw was found in the redirect_uri validation logic in Keycloak.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0095 Published 2024-01-26 Partial fix · 22.0.7-1, 22-6 +11 CWE-601

TI-2023-05639 CVE-2023-6134 · GHSA-cvg2-7c3j-g36j

LOW 27

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01318 Published 2023-12-14 Fixed in 22.0.7-1, 22-6 +11 CWE-79