CVE-2023-2422 — Keycloak: oauth client impersonation
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A clien…
Published: 2023-10-04 · CVSS: 5.5 · CVSS 3.1
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7