CVE-2023-2585: Client Spoofing within the Keycloak Device Authorisation Grant

June 30, 2023

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.

References

github.com/advisories/GHSA-f5h4-wmp5-xhg6
github.com/keycloak/keycloak/commit/04e6244c387a1bde86184635a0049537611e3915
github.com/keycloak/keycloak/security/advisories/GHSA-f5h4-wmp5-xhg6

Detect and mitigate CVE-2023-2585 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →