Search for vulnerabilities
Vulnerability details: VCID-8etu-sejz-kkdy
Vulnerability ID VCID-8etu-sejz-kkdy
Aliases CVE-2023-6544
GHSA-46c8-635v-68r2
Summary Keycloak Authorization Bypass vulnerability Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized. #### Acknowledgements: Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-625 Permissive Regular Expression
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1860
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1860
ssvc Track https://access.redhat.com/errata/RHSA-2024:1860
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1861
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1861
ssvc Track https://access.redhat.com/errata/RHSA-2024:1861
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1862
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1862
ssvc Track https://access.redhat.com/errata/RHSA-2024:1862
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1864
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1864
ssvc Track https://access.redhat.com/errata/RHSA-2024:1864
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1866
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1866
ssvc Track https://access.redhat.com/errata/RHSA-2024:1866
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1867
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1867
ssvc Track https://access.redhat.com/errata/RHSA-2024:1867
cvssv3.1 5.4 https://access.redhat.com/errata/RHSA-2024:1868
generic_textual MODERATE https://access.redhat.com/errata/RHSA-2024:1868
ssvc Track https://access.redhat.com/errata/RHSA-2024:1868
cvssv3 5.4 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6544.json
cvssv3.1 5.4 https://access.redhat.com/security/cve/CVE-2023-6544
generic_textual MODERATE https://access.redhat.com/security/cve/CVE-2023-6544
ssvc Track https://access.redhat.com/security/cve/CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
epss 0.00262 https://api.first.org/data/v1/epss?cve=CVE-2023-6544
cvssv3.1 5.4 https://bugzilla.redhat.com/show_bug.cgi?id=2253116
generic_textual MODERATE https://bugzilla.redhat.com/show_bug.cgi?id=2253116
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2253116
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-46c8-635v-68r2
cvssv3.1 5.4 https://github.com/keycloak/keycloak
generic_textual MODERATE https://github.com/keycloak/keycloak
cvssv3.1 5.4 https://github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2
cvssv3.1_qr MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2
generic_textual MODERATE https://github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2
cvssv3.1 5.4 https://nvd.nist.gov/vuln/detail/CVE-2023-6544
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2023-6544
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2024:1860
https://access.redhat.com/errata/RHSA-2024:1861
https://access.redhat.com/errata/RHSA-2024:1862
https://access.redhat.com/errata/RHSA-2024:1864
https://access.redhat.com/errata/RHSA-2024:1866
https://access.redhat.com/errata/RHSA-2024:1867
https://access.redhat.com/errata/RHSA-2024:1868
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6544.json
https://access.redhat.com/security/cve/CVE-2023-6544
https://api.first.org/data/v1/epss?cve=CVE-2023-6544
https://bugzilla.redhat.com/show_bug.cgi?id=2253116
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2
https://nvd.nist.gov/vuln/detail/CVE-2023-6544
cpe:/a:redhat:build_keycloak:22 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22
cpe:/a:redhat:build_keycloak:22::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22::el9
cpe:/a:redhat:red_hat_single_sign_on:7.6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6
cpe:/a:redhat:red_hat_single_sign_on:7.6::el7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
cpe:/a:redhat:red_hat_single_sign_on:7.6::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
cpe:/a:redhat:red_hat_single_sign_on:7.6::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
cpe:/a:redhat:rhosemc:1.0::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhosemc:1.0::el8
GHSA-46c8-635v-68r2 https://github.com/advisories/GHSA-46c8-635v-68r2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1860
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1860
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1861
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1862
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1864
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1864
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1866
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1866
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1867
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1867
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/errata/RHSA-2024:1868
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/errata/RHSA-2024:1868
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6544.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://access.redhat.com/security/cve/CVE-2023-6544
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://access.redhat.com/security/cve/CVE-2023-6544
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2253116
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-04-25T19:19:09Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2253116
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-46c8-635v-68r2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2023-6544
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.49418
EPSS Score 0.00262
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:30:22.678258+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-46c8-635v-68r2/GHSA-46c8-635v-68r2.json 37.0.0