A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
2023-10-04T11:15:10.157
2024-11-21T07:58:35.333
Modified
CVSSv3.1: 5.5 (MEDIUM)
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | redhat | keycloak | - | Yes |
| Application | redhat | openshift_container_platform | 4.9 | Yes |
| Application | redhat | openshift_container_platform | 4.10 | Yes |
| Application | redhat | openshift_container_platform | 4.11 | Yes |
| Application | redhat | openshift_container_platform | 4.12 | Yes |
| Application | redhat | single_sign-on | 7.6 | Yes |
| Operating System | redhat | enterprise_linux | 7.0 | No |
| Operating System | redhat | enterprise_linux | 8.0 | No |
| Operating System | redhat | enterprise_linux | 9.0 | No |