CVE-2023-6544: Keycloak Authorization Bypass vulnerability

April 17, 2024

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.

References

github.com/advisories/GHSA-46c8-635v-68r2
github.com/keycloak/keycloak
github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2
nvd.nist.gov/vuln/detail/CVE-2023-6544

Code Behaviors & Features

Detect and mitigate CVE-2023-6544 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →