Search for vulnerabilities
Vulnerability details: VCID-ynan-6bh4-cfhq
Vulnerability ID VCID-ynan-6bh4-cfhq
Aliases CVE-2023-6291
GHSA-mpwq-j3xf-7m5w
Summary The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts. The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "[www%2ekeycloak%2eorg%2fapp%2f:y@example.com](https://www%2ekeycloak%2eorg%2fapp%2f:y@example.com/)" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input. ### Acknowledgements Karel Knibbe
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-20 Improper Input Validation
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7854
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7854
ssvc Track https://access.redhat.com/errata/RHSA-2023:7854
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7855
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7855
ssvc Track https://access.redhat.com/errata/RHSA-2023:7855
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7856
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7856
ssvc Track https://access.redhat.com/errata/RHSA-2023:7856
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7857
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7857
ssvc Track https://access.redhat.com/errata/RHSA-2023:7857
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7858
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7858
ssvc Track https://access.redhat.com/errata/RHSA-2023:7858
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7860
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7860
ssvc Track https://access.redhat.com/errata/RHSA-2023:7860
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2023:7861
generic_textual HIGH https://access.redhat.com/errata/RHSA-2023:7861
ssvc Track https://access.redhat.com/errata/RHSA-2023:7861
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:0798
ssvc Track https://access.redhat.com/errata/RHSA-2024:0798
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:0799
ssvc Track https://access.redhat.com/errata/RHSA-2024:0799
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:0800
ssvc Track https://access.redhat.com/errata/RHSA-2024:0800
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:0801
ssvc Track https://access.redhat.com/errata/RHSA-2024:0801
cvssv3.1 7.1 https://access.redhat.com/errata/RHSA-2024:0804
ssvc Track https://access.redhat.com/errata/RHSA-2024:0804
cvssv3 7.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6291.json
cvssv3.1 7.1 https://access.redhat.com/security/cve/CVE-2023-6291
generic_textual HIGH https://access.redhat.com/security/cve/CVE-2023-6291
ssvc Track https://access.redhat.com/security/cve/CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00196 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
epss 0.00203 https://api.first.org/data/v1/epss?cve=CVE-2023-6291
cvssv3.1 7.1 https://bugzilla.redhat.com/show_bug.cgi?id=2251407
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=2251407
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2251407
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-mpwq-j3xf-7m5w
cvssv3.1 7.1 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 7.1 https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b
generic_textual HIGH https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b
cvssv3.1 7.1 https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
cvssv3.1_qr HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
generic_textual HIGH https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
cvssv3.1 7.1 https://nvd.nist.gov/vuln/detail/CVE-2023-6291
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2023-6291
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2023:7854
https://access.redhat.com/errata/RHSA-2023:7855
https://access.redhat.com/errata/RHSA-2023:7856
https://access.redhat.com/errata/RHSA-2023:7857
https://access.redhat.com/errata/RHSA-2023:7858
https://access.redhat.com/errata/RHSA-2023:7860
https://access.redhat.com/errata/RHSA-2023:7861
https://access.redhat.com/errata/RHSA-2024:0798
https://access.redhat.com/errata/RHSA-2024:0799
https://access.redhat.com/errata/RHSA-2024:0800
https://access.redhat.com/errata/RHSA-2024:0801
https://access.redhat.com/errata/RHSA-2024:0804
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6291.json
https://access.redhat.com/security/cve/CVE-2023-6291
https://api.first.org/data/v1/epss?cve=CVE-2023-6291
https://bugzilla.redhat.com/show_bug.cgi?id=2251407
https://github.com/keycloak/keycloak
https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b
https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
https://nvd.nist.gov/vuln/detail/CVE-2023-6291
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:migration_toolkit_for_applications:6.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:migration_toolkit_for_applications:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:migration_toolkit_for_applications:7.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
cpe:/a:redhat:build_keycloak:22 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22
cpe:/a:redhat:build_keycloak:22::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:build_keycloak:22::el9
cpe:/a:redhat:jboss_data_grid:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_data_grid:7
cpe:/a:redhat:jboss_data_grid:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_data_grid:8
cpe:/a:redhat:jboss_enterprise_application_platform:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_application_platform:6
cpe:/a:redhat:jboss_enterprise_bpms_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_bpms_platform:7
cpe:/a:redhat:jboss_enterprise_brms_platform:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_enterprise_brms_platform:7
cpe:/a:redhat:jboss_fuse:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:jboss_fuse:7
cpe:/a:redhat:migration_toolkit_applications:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:migration_toolkit_applications:6
cpe:/a:redhat:migration_toolkit_applications:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:migration_toolkit_applications:7
cpe:/a:redhat:red_hat_single_sign_on:7.6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6
cpe:/a:redhat:red_hat_single_sign_on:7.6.6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6.6
cpe:/a:redhat:red_hat_single_sign_on:7.6::el7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
cpe:/a:redhat:red_hat_single_sign_on:7.6::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
cpe:/a:redhat:red_hat_single_sign_on:7.6::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
cpe:/a:redhat:rhosemc:1.0::el8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhosemc:1.0::el8
cpe:/a:redhat:serverless:1 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:serverless:1
GHSA-mpwq-j3xf-7m5w https://github.com/advisories/GHSA-mpwq-j3xf-7m5w
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7854
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7854
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7855
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7855
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7856
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7856
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7857
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7857
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7858
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7858
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7860
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7860
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2023:7861
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2023:7861
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:0798
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2024:0798
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:0799
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2024:0799
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:0800
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2024:0800
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:0801
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2024:0801
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/errata/RHSA-2024:0804
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/errata/RHSA-2024:0804
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-6291.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://access.redhat.com/security/cve/CVE-2023-6291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://access.redhat.com/security/cve/CVE-2023-6291
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://bugzilla.redhat.com/show_bug.cgi?id=2251407
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-11-13T14:56:46Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2251407
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/keycloak/keycloak/commit/b2e91105315ccf2c1df549b4f6c5948322cbfd1b
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://github.com/keycloak/keycloak/security/advisories/GHSA-mpwq-j3xf-7m5w
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2023-6291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.41957
EPSS Score 0.00196
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:42:10.991433+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/12/GHSA-mpwq-j3xf-7m5w/GHSA-mpwq-j3xf-7m5w.json 37.0.0