3.5
Low
CVE-2023-2585 Keycloak's device authorization grant does not correctly validate the device code and client ID
Description
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Single Sign-On 7 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 7 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 8 | Versions not published | |
| Red Hat Single Sign-On 7.6 for RHEL 9 | Versions not published | |
| RHEL-8 based Middleware Containers 7.6 | earliest → < 7.6-24 | 7.6-24 |
Other CVEs of Red Hat Single Sign-On 7
The 295 CVEs of Red Hat Single Sign-On 7 →
CVE-2026-120984
Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import
9.1
Critical
CVE-2026-97848
Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
6.5
Medium
CVE-2026-97367
Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
6.4
Medium
CVE-2026-96547
Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
6.5
Medium