Insufficient Session Expiration in Keycloak - CVE-2023-0657
Published: April 17, 2024
Vulnerability identifier: #VU88796
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-0657
CWE-ID: CWE-613
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to software does not properly enforce token types when validating signatures locally. An authenticated user can use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.
Affected software
Keycloak
How to mitigate CVE-2023-0657
Install updates from vendor's website.
Keycloak - addressed in versions 22.0.10, 24.0.3