Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-12-21T09:24:16.632Z

Updated: 2024-08-02T06:26:09.896Z

Reserved: 2023-05-08T19:39:58.370Z

Link: CVE-2023-2585

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-12-21T10:15:34.533

Modified: 2024-11-21T07:58:52.737

Link: CVE-2023-2585

cve-icon Redhat

Severity : Low

Publid Date: 2023-06-26T00:00:00Z

Links: CVE-2023-2585 - Bugzilla