Read the docs
TI-2017-08951 Aliases CVE-2017-12160GHSA-qc72-gfvw-76h7

Improper authorization in Red Hat keycloak

Priority LOW 35CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 3 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-285.

Summary

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.

Why it matters now

EPSS 0.01924 80th percentileScored 2026-11-07
Fix Partial org.keycloak:keycloak-parent (Maven): 3.3.0.FinalRed Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatkeycloak3.4.0—No fix listedCNA
—org.keycloak:keycloak-parent (Maven)before 3.3.0.Final3.3.0.FinalPatch availableGHSA-qc72-gfvw-76h7
  • keycloak VendorRed Hat Affected 3.4.0 Fixed in — No fix listed CNA
  • org.keycloak:keycloak-parent (Maven) Vendor— Affected before 3.3.0.Final Fixed in 3.3.0.Final Patch available GHSA-qc72-gfvw-76h7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-qc72-gfvw-76h7 org.keycloak:keycloak-parent (Maven) Fixed in 3.3.0.Final Advisory →

Red Hat 3 advisories

  • RHSA-2017:2905 Released 2017-10-17 · Red Hat rating Moderate
    rh-sso7-keycloak security update
    • Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el7
  • RHSA-2017:2904 Released 2017-10-17 · Red Hat rating Moderate
    rh-sso7-keycloak security update
    • Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el6, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el6
  • RHSA-2017:2906 Released 2017-10-17 · Red Hat rating Moderate
    Red Hat Single Sign-On security update
    • Red Hat Single Sign-On 7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat keycloak — RHSA-2017:2904

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2017-08950 Insufficient session expiration in Red Hat keycloakPriority LOW 38
    • TI-2017-08949 Cross-site scripting in Red Hat keycloakPriority LOW 26
    Show all 3 records → Advisory →
  • Advisory ·

    Red Hat keycloak — RHSA-2017:2905

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2017-08950 Insufficient session expiration in Red Hat keycloakPriority LOW 38
    • TI-2017-08949 Cross-site scripting in Red Hat keycloakPriority LOW 26
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat keycloak — RHSA-2017:2906

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2017-08950 Insufficient session expiration in Red Hat keycloakPriority LOW 38
    • TI-2017-08949 Cross-site scripting in Red Hat keycloakPriority LOW 26
    Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Mobile Application Platform 4AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7.1Fixed RHSA-2017:2906
Red Hat Single Sign-On 7.1 for RHEL 6 ServerFixed RHSA-2017:2904
Red Hat Single Sign-On 7.1 for RHEL 7 ServerFixed RHSA-2017:2905

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12160
  2. 2026-10-03 Alias added: GHSA-qc72-gfvw-76h7

References

Advisory 5

Other 1

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences