CVE-2023-2585: Client Spoofing within the Keycloak Device Authorisation Grant

June 30, 2023

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.

References

github.com/advisories/GHSA-f5h4-wmp5-xhg6
github.com/keycloak/keycloak/commit/04e6244c387a1bde86184635a0049537611e3915
github.com/keycloak/keycloak/security/advisories/GHSA-f5h4-wmp5-xhg6

Code Behaviors & Features

Detect and mitigate CVE-2023-2585 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →