CVE-2022-1245: Missing Authorization

July 8, 2022 (updated November 7, 2023)

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.

References

github.com/advisories/GHSA-75p6-52g3-rqc8
github.com/keycloak/keycloak/security/advisories/GHSA-75p6-52g3-rqc8
nvd.nist.gov/vuln/detail/CVE-2022-1245

Code Behaviors & Features

Detect and mitigate CVE-2022-1245 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →