Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
CVE-2024-4540

7.5HIGH

Key Information:

Status: Red Hat Build Of Keycloak; Red Hat Build Of Keycloak 22; Red Hat Build Of Keycloak 24
Vendor: CVE Published:; 3 June 2024

What is CVE-2024-4540?

A vulnerability exists in Keycloak related to OAuth 2.0 Pushed Authorization Requests (PAR). This issue arises from client-provided parameters being transmitted in plain text within the KC_RESTART cookie included in the HTTP response of the authorization server during a request_uri authorization request. This situation could potentially lead to unauthorized information disclosure, allowing attackers to access sensitive data inadvertently exposed through these cookies. It's crucial for users and administrators to review their Keycloak implementations for configurations susceptible to this flaw.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch