CVE-2023-0091

Keycloak has lack of validation of access token on client registrations endpoint

3.8 LowFix available

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.48%Down 0.4 points since Jan 13, 2023

What each source reports

NVD Score used 3.8

Record: CVE-2023-0091
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

CVE List 3.8

Record: CVE-2023-0091
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

EUVDEUVD-2023-0552 3.8

Record: EUVD-2023-0552
CVSS 3.1: 3.8 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-v436-q368-hvgg 6.5

Keycloak has lack of validation of access token on client registrations endpoint

When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.

If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.

Record: GHSA-v436-q368-hvgg
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-284, CWE-863
Updated: 2026-11-02

OSVGHSA-v436-q368-hvgg 6.5

Keycloak has lack of validation of access token on client registrations endpoint

When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.

If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.

Record: GHSA-v436-q368-hvgg
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness: CWE-284, CWE-863
Updated: 2026-11-02

OSVRHSA-2023:1043 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7

Record: RHSA-2023:1043
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:1044 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8

Record: RHSA-2023:1044
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:1045 9.8

Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9

Record: RHSA-2023:1045
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.keycloak:keycloak-core` Maven	through 20.0.2	20.0.3
`org.keycloak:keycloak-core` Maven	before 20.0.3, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less 1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final	20.0.3
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el7	before 0:18.0.6-1.redhat_00001.1.el7sso	0:18.0.6-1.redhat_00001.1.el7sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el7	before 0:18.0.6-1.redhat_00001.1.el7sso	0:18.0.6-1.redhat_00001.1.el7sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el8	before 0:18.0.6-1.redhat_00001.1.el8sso	0:18.0.6-1.redhat_00001.1.el8sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el8	before 0:18.0.6-1.redhat_00001.1.el8sso	0:18.0.6-1.redhat_00001.1.el8sso
`rh-sso7-keycloak` Red Hat:red_hat_single_sign_on:7.6::el9	before 0:18.0.6-1.redhat_00001.1.el9sso	0:18.0.6-1.redhat_00001.1.el9sso
`rh-sso7-keycloak-server` Red Hat:red_hat_single_sign_on:7.6::el9	before 0:18.0.6-1.redhat_00001.1.el9sso	0:18.0.6-1.redhat_00001.1.el9sso

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-0091 is a low vulnerability (CVSS 3.8) in Redhat Keycloak, published January 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in org.keycloak:keycloak-core 20.0.3.

References

Show 147 moreShow less

This page doesn't list everything

Left out here: 95 versions. The JSON record has them.