vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-2422

Keycloak: oauth client impersonation

HIGH
7.1
CVSS Score
Published: October 4, 2023 at 10:59 AM UTC
Updated: June 17, 2026 at 05:52 AM UTC
4 products affected across 2 vendorsOpenShift Container PlatformSingle Sign onKeycloak

Using Red Hat Single Sign-On 7 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Single Sign-On 7 - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.5%
SSVC
No known exploit

Description

A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Keycloak· Keycloak
95%
All versions
redhat-enterprise-linux (environment)
OpenShift Container Platform· Red Hatcontainer
95%
4.104.114.124.9
redhat-enterprise-linux (environment)
Single Sign on· Red Hatrpm
95%
7.6
Vendor states this is fixed in 0:18.0.8-1.redhat_00001.1.el7sso (unaffected)
Vendor states this is fixed in 0:18.0.8-1.redhat_00001.1.el8sso (unaffected)
Vendor states this is fixed in 0:18.0.8-1.redhat_00001.1.el9sso (unaffected)
Vendor states this is fixed in 7.6.4 (unaffected)
redhat-enterprise-linux (environment)
Enterprise Linux· Red Hatrpmdevice
80%
All versions

References (7)

Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:3883
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:3884
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:3885
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:3888
Vendor Advisoryx_refsource_REDHAT
Source: [email protected]
https://access.redhat.com/errata/RHSA-2023:3892
VDB Entryx_refsource_REDHATVendor Advisory
Source: [email protected]
https://access.redhat.com/security/cve/CVE-2023-2422
Issue Trackingx_refsource_REDHATVendor Advisory
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=2191668

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-295

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card