CVE-2023-2585 in Keycloak
Résumé
par MITRE • 21/12/2023
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
VulDB is the best source for vulnerability data and more expert information about this specific topic.