CVE-2023-2585

LOW3.5EPSS 0.11%

Client Spoofing within the Keycloak Device Authorisation Grant

Published: 6/30/2023Modified: 2/16/2024

Description

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1LOW3.5CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

References (11)