Executive brief
Client Spoofing within the Keycloak Device Authorisation Grant
Affected products
- Maven org.keycloak:keycloak-server-spi-private
- Maven org.keycloak:keycloak-services
Junglewise Threat Intelligence
CVE-2023-2585: Client Spoofing within the Keycloak Device Authorisation Grant
CVE-2023-2585 · Severity: low · CVSS 3.1 · Published 2023-06-30
Technologies: org.keycloak:keycloak-server-spi-private (Maven), org.keycloak:keycloak-services (Maven). Vendors: Maven.
Related threats
- Keycloak information disclosure via user profile permission bypass in group members endpoint
- Keycloak privilege escalation in Fine-Grained Admin Permissions scope mapping
- Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement
- Keycloak privilege escalation in Fine-Grained Admin Permissions
- Keycloak signature policy bypass in JWE-encrypted request objects