CVE-2023-0657

LOW3.4EPSS 0.05%

Keycloak vulnerable to impersonation via logout token exchange

發布日:2024/4/17修改日:2026/2/4

描述

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

受影響套件(1)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1LOW3.4CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

參考連結(7)