medium5.0
CVE-2023-0264
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.
Impact
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Keycloak | before 18.0.6 |
| Redhat | Single Sign-On | before 7.6.2 All versions |
| Redhat | Openshift Container Platform | Versions 4.9, 4.10 |
| Redhat | Openshift Container Platform For Ibm Linuxone | Versions 4.9, 4.10 |
| Redhat | Openshift Container Platform Ibm Z Systems | Versions 4.9, 4.10 |