CVE-2024-4540

HIGH7.5EPSS 0.31%

Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

Published: 6/10/2024Modified: 2/4/2026
Also known as:GHSA-69fp-7c8p-crjrCGA-47pj-fc95-qg2p

Description

A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability.

Affected packages (1)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1HIGH7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (15)