Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
CVE-2024-4540
7.5HIGH
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 3 June 2024
What is CVE-2024-4540?
A vulnerability exists in Keycloak related to OAuth 2.0 Pushed Authorization Requests (PAR). This issue arises from client-provided parameters being transmitted in plain text within the KC_RESTART cookie included in the HTTP response of the authorization server during a request_uri
authorization request. This situation could potentially lead to unauthorized information disclosure, allowing attackers to access sensitive data inadvertently exposed through these cookies. It's crucial for users and administrators to review their Keycloak implementations for configurations susceptible to this flaw.
Affected Version(s)
Red Hat build of Keycloak 22 22.0.11-2
Red Hat build of Keycloak 22 22-15
Red Hat build of Keycloak 22 22-18