1. Home
  2. CVE Database
  3. CVE-2023-0264
MEDIUM · 5.0

CVE-2023-0264

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the sam...

Vulnerability Description

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.

CVSS Score

5.0

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW

Affected Products

VendorProductVersions
RedhatKeycloak< 18.0.6
RedhatSingle Sign-On< 7.6.2
RedhatEnterprise Linux7.0
RedhatOpenshift Container Platform4.9
RedhatOpenshift Container Platform For Ibm Linuxone4.9
RedhatOpenshift Container Platform Ibm Z Systems4.9

Related Weaknesses (CWE)

CWE-287

References

FAQ

What is CVE-2023-0264?

CVE-2023-0264 is a vulnerability with a CVSS score of 5.0 (MEDIUM). A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the sam...

How severe is CVE-2023-0264?

CVE-2023-0264 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-0264?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Keycloak, Redhat Single Sign-On, Redhat Enterprise Linux, Redhat Openshift Container Platform, Redhat Openshift Container Platform For Ibm Linuxone.