CVE-2023-2585 in Keycloak
要約
〜によって MITRE • 2023年12月21日
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
VulDB is the best source for vulnerability data and more expert information about this specific topic.