CVE-2023-2585
Keycloak: client access via device auth request spoof
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Keycloak: client access via device auth request spoof
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
- Record
CVE-2023-2585- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
EUVDEUVD-2023-1780
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
- Record
EUVD-2023-1780- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f5h4-wmp5-xhg6
Client Spoofing within the Keycloak Device Authorisation Grant
Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.
- Record
GHSA-f5h4-wmp5-xhg6- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
NVD
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.
- Record
CVE-2023-2585- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
OSVGHSA-f5h4-wmp5-xhg6
Client Spoofing within the Keycloak Device Authorisation Grant
Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.
- Record
GHSA-f5h4-wmp5-xhg6- CVSS 3.1
- 3.5 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
OSVRHSA-2023:3883
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 7
- Record
RHSA-2023:3883- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2023:3884
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 8
- Record
RHSA-2023:3884- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2023:3885
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 9
- Record
RHSA-2023:3885- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
- red hat single sign-on 7
- red hat single sign-on 7.6 for rhel 7
- red hat single sign-on 7.6 for rhel 8
- red hat single sign-on 7.6 for rhel 9
- red hat rhel-8 based middleware containers
- redhat openshift container platform
- redhat openshift container platform for ibm z
- redhat openshift container platform for linuxone
- redhat openshift container platform for power
- redhat single sign-on
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven |
before 21.1.2 | 21.1.2 |
org.keycloak:keycloak-server-spi-privateMaven |
before 21.1.2 | 21.1.2 |
org.keycloak:keycloak-servicesMaven |
before 21.1.2, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
21.1.2 |
org.keycloak:keycloak-server-spi-privateMaven |
before 21.1.2, plus listed versions 10.0.010.0.110.0.211.0.011.0.1 Show 45 moreShow less11.0.211.0.312.0.012.0.112.0.212.0.312.0.413.0.013.0.114.0.015.0.015.0.115.0.215.1.015.1.116.0.016.1.016.1.117.0.017.0.118.0.018.0.118.0.219.0.019.0.119.0.219.0.32.4.0.CR12.4.0.Final2.5.0.CR12.5.0.Final2.5.1.Final2.5.4.Final2.5.5.Final20.0.020.0.120.0.220.0.320.0.420.0.521.0.021.0.121.0.221.1.021.1.1 |
21.1.2 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 5 CVEs |
before 0:18.0.8-1.redhat_00001.1.el7sso | 0:18.0.8-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 5 CVEs |
before 0:18.0.8-1.redhat_00001.1.el7sso | 0:18.0.8-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 5 CVEs |
before 0:18.0.8-1.redhat_00001.1.el8sso | 0:18.0.8-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 5 CVEs |
before 0:18.0.8-1.redhat_00001.1.el8sso | 0:18.0.8-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 5 CVEs |
before 0:18.0.8-1.redhat_00001.1.el9sso | 0:18.0.8-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 5 CVEs |
before 0:18.0.8-1.redhat_00001.1.el9sso | 0:18.0.8-1.redhat_00001.1.el9sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2585 is a low vulnerability (CVSS 3.5) in Red Hat Single Sign-on 7, published June 30, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in org.keycloak:keycloak-services 21.1.2.
References
access.redhat.com/errata/RHSA-2023:3883
Show 30 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2196335
github.com/keycloak/keycloak/security/advisories/GHSA-f5h4-wmp5-xhg6
nvd.nist.gov/vuln/detail/CVE-2023-2585
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3883.json
cve.org/CVERecord?id=CVE-2022-4361
Left out here: 146 versions. The JSON record has them.