Keycloak Authorization Bypass vulnerability

TRUNG BÌNH 5.4CVE-2023-6544 · GHSA-46c8-635v-68r2 · Công bố 25/04/2024 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-6544 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng org.keycloak:keycloak-services.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 65.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 24.0.3, 22.0.10 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
org.keycloak:keycloak-services Maven	`≥ 23.0.0, < 24.0.3< 22.0.10`	`24.0.322.0.10`

Mô tả

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.

Acknowledgements:

Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.

Mô tả của NVD

A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized.