Read the docs
TI-2023-00250 Aliases CVE-2023-0264GHSA-9g98-5mj6-f9mv

Improper authentication in Red Hat Keycloak

Priority LOW 25CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-287.

Summary

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

Why it matters now

EPSS 0.01274 70th percentileScored 2026-11-07
Fix Fixed Keycloak (redhat.com): 18.0.6org.keycloak:keycloak-services (Maven): 21.0.1Red Hat: 5 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatKeycloak18.0.6 to before 18.0.618.0.6Patch availableCNA
—org.keycloak:keycloak-services (Maven)before 21.0.121.0.1Patch availableGHSA-9g98-5mj6-f9mv
  • Keycloak VendorRed Hat Affected 18.0.6 to before 18.0.6 Fixed in 18.0.6 Patch available CNA
  • org.keycloak:keycloak-services (Maven) Vendor— Affected before 21.0.1 Fixed in 21.0.1 Patch available GHSA-9g98-5mj6-f9mv

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*before 18.0.6VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*before 7.6.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*9.0Running onRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*4.9VulnerableRed Hat
  • cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* Versions before 18.0.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:* Versions before 7.6.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_linuxone:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Red Hat
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*4.10VulnerableRed Hat
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*not specified by NVDVulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* Versions not specified by NVD Vulnerable ·Red Hat

Remediation

  • Fix · CNA Keycloak (redhat.com) Fixed in 18.0.6
  • Fix · GHSA-9g98-5mj6-f9mv org.keycloak:keycloak-services (Maven) Fixed in 21.0.1 Advisory →

Red Hat 5 advisories

  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
Show 2 more Red Hat advisories
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Middleware Containers for OpenShiftFixed RHSA-2023:1047
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Not affected: 2 products
  • Red Hat A-MQ Online
  • Red Hat JBoss Enterprise Application Platform 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-0264
  2. 2026-10-03 Alias added: GHSA-9g98-5mj6-f9mv

References

Advisory 2

Other 3

  • TI-2024-01049 Keycloak: path transversal in redirection validation CVSS 3.1HIGH 8.1
  • TI-2023-26623 The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6… CVSS 3.1MEDIUM 5.9
  • TI-2020-08665 Server-side request forgery in keycloak CVSS 3.1MEDIUM 5.3
  • TI-2022-03468 Path traversal in Red Hat Keycloak CVSS 3.1CRITICAL 9.1
  • TI-2021-03612 A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. CVSS 3.1MEDIUM 6.1
  • TI-2022-03994 Cross-site scripting in keycloak CVSS 3.1CRITICAL 10.0
See all 97 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences