SB2023030251 - User impersonation in Keycloak
Published: March 2, 2023 Updated: May 31, 2024
Security Bulletin ID
SB2023030251
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2023-0264)
The vulnerability allows a remote user to impersonate application users.
The vulnerability exists due to an error when handling authentication requests in the OpenID Connect user authentication. A remote authenticated user who can obtain a certain piece of info from a victim's user request from the same realm can use that data to impersonate the victim and generate new session tokens.
Remediation
Install update from vendor's website.