Keycloak: open redirect via "form_post.jwt" jarm response mode
Summary
| CVE | CVE-2023-6927 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-12-18 23:15:10 UTC |
| Updated | 2026-09-22 04:17:56 UTC |
| Description | A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134. |
Risk And Classification
Primary CVSS: v3.1 6.1 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.011090000 probability, percentile 0.644320000 (date 2026-09-22)
Problem Types: CWE-601 | CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 6.1 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | [email protected] | Secondary | 4.6 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 4.6 | MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
RequiredScope
ChangedConfidentiality
LowIntegrity
LowAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Keycloak | - | All | All | All |
| Application | Redhat | Single Sign-on | 7.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Build Of Keycloak 22 | unaffected 22-7 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 22.0.8 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7.6 For RHEL 7 | unaffected 0:18.0.11-3.redhat_00001.1.el7sso * rpm | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7.6 For RHEL 7 | unaffected 0:18.0.12-1.redhat_00001.1.el7sso * rpm | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7.6 For RHEL 8 | unaffected 0:18.0.11-3.redhat_00001.1.el8sso * rpm | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7.6 For RHEL 8 | unaffected 0:18.0.12-1.redhat_00001.1.el8sso * rpm | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7.6 For RHEL 9 | unaffected 0:18.0.11-3.redhat_00001.1.el9sso * rpm | Not specified |
| CNA | Red Hat | Red Hat Single Sign-On 7.6 For RHEL 9 | unaffected 0:18.0.12-1.redhat_00001.1.el9sso * rpm | Not specified |
| CNA | Red Hat | RHEL-8 Based Middleware Containers | unaffected 7.6-39 * rpm | Not specified |
| CNA | Red Hat | RHEL-8 Based Middleware Containers | unaffected 7.6-41 * rpm | Not specified |
| CNA | Red Hat | Single Sign-On 7.6.6 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2024:0100 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0798 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2023-6927 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:0096 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0094 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0098 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0801 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:0800 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0804 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0095 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0097 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0799 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0101 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Red Hat would like to thank Pontus Hanssen ([email protected]) for reporting this issue. (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2023-12-18T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2023-12-18T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 996383 Java (Maven) Security Update for org.keycloak:keycloak-parent (GHSA-3p75-q5cc-qmj7)