Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
Priority MEDIUM 40CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-312.
Summary
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00551 46th percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-services (Maven): 24.0.5Red Hat: 9 advisories
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat Build of Keycloak | — | — | Not affected | CNA |
| Red Hat | Red Hat build of Keycloak 22 | — | 22.0.11-2 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 22 | — | 22-15 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 22 | — | 22-18 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 24 | — | 24.0.5-2 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 24 | — | 24-10 | Patch available | CNA |
| Red Hat | Red Hat build of Keycloak 24 | — | 24-10 | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | — | 18.0.14-1.redhat_00001.1.el7sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | — | 18.0.14-1.redhat_00001.1.el8sso | Patch available | CNA |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | — | 18.0.14-1.redhat_00001.1.el9sso | Patch available | CNA |
| Red Hat | RHEL-8 based Middleware Containers | — | 7.6-49 | Patch available | CNA |
| — | org.keycloak:keycloak-services (Maven) | before 24.0.5 | 24.0.5 | Patch available | GHSA-69fp-7c8p-crjr |
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Build of Keycloak VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat build of Keycloak 22 VendorRed Hat Affected — Fixed in 22.0.11-2 Patch available CNA
- Red Hat build of Keycloak 22 VendorRed Hat Affected — Fixed in 22-15 Patch available CNA
- Red Hat build of Keycloak 22 VendorRed Hat Affected — Fixed in 22-18 Patch available CNA
- Red Hat build of Keycloak 24 VendorRed Hat Affected — Fixed in 24.0.5-2 Patch available CNA
- Red Hat build of Keycloak 24 VendorRed Hat Affected — Fixed in 24-10 Patch available CNA
- Red Hat build of Keycloak 24 VendorRed Hat Affected — Fixed in 24-10 Patch available CNA
- Red Hat Single Sign-On 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Single Sign-On 7.6 for RHEL 7 VendorRed Hat Affected — Fixed in 18.0.14-1.redhat_00001.1.el7sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 8 VendorRed Hat Affected — Fixed in 18.0.14-1.redhat_00001.1.el8sso Patch available CNA
- Red Hat Single Sign-On 7.6 for RHEL 9 VendorRed Hat Affected — Fixed in 18.0.14-1.redhat_00001.1.el9sso Patch available CNA
- RHEL-8 based Middleware Containers VendorRed Hat Affected — Fixed in 7.6-49 Patch available CNA
- org.keycloak:keycloak-services (Maven) Vendor— Affected before 24.0.5 Fixed in 24.0.5 Patch available GHSA-69fp-7c8p-crjr
CPE names CNA · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:build_keycloak:22 | 22 | — | Red Hat |
| cpe:/a:redhat:build_keycloak:24 | 24 | — | Red Hat |
| cpe:/a:redhat:build_keycloak:22::el9 | 22 | — | Red Hat |
| cpe:/a:redhat:build_keycloak:24::el9 | 24 | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7.6 | 7.6 | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7.6::el7 | 7.6 | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7.6::el8 | 7.6 | — | Red Hat |
| cpe:/a:redhat:red_hat_single_sign_on:7.6::el9 | 7.6 | — | Red Hat |
| cpe:/a:redhat:rhosemc:1.0::el8 | 1.0 | — | Red Hat |
- cpe:/a:redhat:build_keycloak:22 Versions 22 — ·Red Hat
- cpe:/a:redhat:build_keycloak:24 Versions 24 — ·Red Hat
- cpe:/a:redhat:build_keycloak:22::el9 Versions 22 — ·Red Hat
- cpe:/a:redhat:build_keycloak:24::el9 Versions 24 — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7.6 Versions 7.6 — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7.6::el7 Versions 7.6 — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7.6::el8 Versions 7.6 — ·Red Hat
- cpe:/a:redhat:red_hat_single_sign_on:7.6::el9 Versions 7.6 — ·Red Hat
- cpe:/a:redhat:rhosemc:1.0::el8 Versions 1.0 — ·Red Hat
Remediation
- Fix · GHSA-69fp-7c8p-crjr org.keycloak:keycloak-services (Maven) Fixed in 24.0.5 Advisory →
Red Hat 9 advisories
- RHSA-2024:3576 Released 2024-06-03 · Red Hat rating LowRed Hat build of Keycloak 24.0.5 Images enhancement and security update
- Red Hat build of Keycloak 24 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
- RHSA-2024:3575 Released 2024-06-03 · Red Hat rating LowRed Hat build of Keycloak 24.0.5 enhancement and security update
- Red Hat Build of Keycloak
- RHSA-2024:3573 Released 2024-06-03 · Red Hat rating LowRed Hat build of Keycloak 22.0.11 Images enhancement and security update
- Red Hat build of Keycloak 22 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
Show 6 more Red Hat advisories
- RHSA-2024:3574 Released 2024-06-03 · Red Hat rating LowRed Hat build of Keycloak 22.0.11 enhancement and security update
- Red Hat Build of Keycloak
- RHSA-2024:3572 Released 2024-06-03 · Red Hat rating LowRed Hat Single Sign-On 7.6.9 security update
- Red Hat Single Sign-On 7
- RHSA-2024:3570 Released 2024-06-03 · Red Hat rating LowRed Hat Single Sign-On 7.6.9 for OpenShift image enhancement update
- Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
- RHSA-2024:3566 Released 2024-06-03 · Red Hat rating LowRed Hat Single Sign-On 7.6.9 security update on RHEL 7
- Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.14-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.14-1.redhat_00001.1.el7sso
- RHSA-2024:3567 Released 2024-06-03 · Red Hat rating LowRed Hat Single Sign-On 7.6.9 security update on RHEL 8
- Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.14-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.14-1.redhat_00001.1.el8sso
- RHSA-2024:3568 Released 2024-06-03 · Red Hat rating LowRed Hat Single Sign-On 7.6.9 security update on RHEL 9
- Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.14-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.14-1.redhat_00001.1.el9sso
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Middleware Containers for OpenShift | Fixed | RHSA-2024:3570 |
| Red Hat Build of Keycloak | Fixed | RHSA-2024:3574 |
| Red Hat Single Sign-On 7 | Fixed | RHSA-2024:3572 |
| Red Hat Single Sign-On 7.6 for RHEL 7 Server | Fixed | RHSA-2024:3566 |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Fixed | RHSA-2024:3567 |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Fixed | RHSA-2024:3568 |
| Red Hat build of Keycloak 22 | Fixed | RHSA-2024:3573 |
| Red Hat build of Keycloak 24 | Fixed | RHSA-2024:3576 |
Timeline
- 2026-10-02 Threatist record created from CVE-2024-4540
- 2026-10-03 Alias added: GHSA-69fp-7c8p-crjr
References
Advisory 10
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-4540 · CVE Program
- CVE-2024-4540 · NVD
- FIRST EPSS
- GHSA-69fp-7c8p-crjr · GitHub Advisory Database · CC BY 4.0
- CVE-2024-4540 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences