Описание
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
Отчет
The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires high administrative privileges to exploit. Successful exploitation allows an attacker to rebind and capture an OIDC client secret by modifying identity provider configuration fields. The vulnerability's root cause is the unconditional reuse of masked secrets during configuration updates without verifying if sensitive endpoint fields have changed.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Build of Keycloak | keycloak-services | Affected | ||
| Red Hat Build of Keycloak | rhbk-keycloak-rhel9/rhbk-keycloak-rhel9 | Affected | ||
| Red Hat Build of Keycloak | rhbk-openshift-rhel9/rhbk-openshift-rhel9 | Affected | ||
| Red Hat Data Grid 8 | keycloak-services | Not affected | ||
| Red Hat JBoss Enterprise Application Platform Expansion Pack | keycloak-services | Not affected | ||
| Red Hat Single Sign-On 7 | keycloak-services | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
A flaw was found in the Keycloak keycloak-services component, which ha ...
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
EPSS
5.5 Medium
CVSS3