CVE-2023-2585 — Keycloak: client access via device auth request spoof
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent …
Published: 2023-12-21 · CVSS: 3.5 · CVSS 3.1
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7