Keycloak has lack of validation of access token on client registrations endpoint

LOW 3.8CVE-2023-0091 · GHSA-v436-q368-hvgg · Published 13/01/2023 · updated 17/06/2026

In short

CVE-2023-0091 is a LOW (CVSS 3.8) vulnerability affecting org.keycloak:keycloak-core.
Chance of exploitation in the next 30 days (EPSS): 0.48%, higher than 41.4% of all vulnerabilities.
Fix: update to 20.0.3 or later.

Package	Affected versions	Patched versions
org.keycloak:keycloak-core Maven	`< 20.0.3`	`20.0.3`

Description

When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.

If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.

NVD description

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

References

keycloak/keycloak security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-0091 · ADVISORY
access.redhat.com/security/cve/CVE-2023-0091 · WEB
keycloak/keycloak · PACKAGE

More vulnerabilities in org.keycloak:keycloak-core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

org.keycloak:keycloak-core

Maven

< 20.0.3

20.0.3

Description

When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.

If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.

NVD description

More vulnerabilities in org.keycloak:keycloak-core

See all →