Main
Vulnerability Database
Exploits
ID:9873 - Exploit for Authentication bypass using an alternate path or channel in Keycloak - CVE-2023-0264
ID:9873 - Exploit for Authentication bypass using an alternate path or channel in Keycloak - CVE-2023-0264
Published: May 31, 2024
Vulnerability identifier: #VU72725
Vulnerability risk: Medium
CVE-ID: CVE-2023-0264
CWE-ID: CWE-288
Exploitation vector: Remote access
Vulnerable software:
Keycloak
Keycloak
Link to public exploit:
Vulnerability description
The vulnerability allows a remote user to impersonate application users.
The vulnerability exists due to an error when handling authentication requests in the OpenID Connect user authentication. A remote authenticated user who can obtain a certain piece of info from a victim's user request from the same realm can use that data to impersonate the victim and generate new session tokens.
Remediation
Install updates from vendor's website.