{"id":"CVE-2023-0264","state":"PUBLISHED","title":"A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user re","description":"A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.","publishedAt":"2023-08-04T17:09:27.693Z","updatedAt":"2024-08-02T05:02:44.110Z","severity":null,"assigner":"redhat","products":["redhat.com Keycloak"],"affected":[{"vendor":"redhat.com","product":"Keycloak","defaultStatus":"unaffected","versions":[{"version":"18.0.6","status":"affected","lessThan":"18.0.6","versionType":"semver"}]}],"references":["https://access.redhat.com/security/cve/CVE-2023-0264"],"weaknesses":[],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/0xxx/CVE-2023-0264.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-0264","state":"PUBLISHED","datePublished":"2023-08-04T17:09:27.693Z","dateUpdated":"2024-08-02T05:02:44.110Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-01-12T23:10:37.812Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability."}],"affected":[{"vendor":"redhat.com","product":"Keycloak","defaultStatus":"unaffected","versions":[{"version":"18.0.6","status":"affected","lessThan":"18.0.6","versionType":"semver"}]}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-0264"}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2023-08-04T17:09:27.693Z"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-0264","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T05:02:44.110Z"}}]}}}