CVE-2023-2422: Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients

October 4, 2023 (updated November 9, 2023)

When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients.

References

github.com/advisories/GHSA-3qh5-qqj2-c78f
github.com/keycloak/keycloak/commit/5c6c55945a384bfd82e51283096204dcb6f63d91
github.com/keycloak/keycloak/security/advisories/GHSA-3qh5-qqj2-c78f

Code Behaviors & Features

Detect and mitigate CVE-2023-2422 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →