CVE-2023-6134

MediumCVSS 5.4/10Last modified Sep 22, 2026

Description

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
Red HatRed Hat build of Keycloak 22—
Red HatRed Hat build of Keycloak 22—
Red HatRed Hat build of Keycloak 22—
Red HatRed Hat build of Keycloak 22.0.7—
Red HatRed Hat Single Sign-On 7—
Red HatRed Hat Single Sign-On 7.6 for RHEL 7—
Red HatRed Hat Single Sign-On 7.6 for RHEL 7—
Red HatRed Hat Single Sign-On 7.6 for RHEL 8—
Red HatRed Hat Single Sign-On 7.6 for RHEL 8—
Red HatRed Hat Single Sign-On 7.6 for RHEL 9—
Red HatRed Hat Single Sign-On 7.6 for RHEL 9—
Red HatRHEL-8 based Middleware Containers—
Red HatRHEL-8 based Middleware Containers—
Red HatRHEL-8 based Middleware Containers—
Red HatSingle Sign-On 7.6.6—

References

Timeline

Published
Dec 14, 2023
Last modified
Sep 22, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-61354.3Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". This attack could potentially allow an attacker to reCVE-2023-61367.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: froCVE-2023-61378.8Cross-Site Request Forgery (CSRF) vulnerability in finnj Frontier Post allows Cross Site Request Forgery.This issue affects Frontier Post: fCVE-2023-61387.9A potential security vulnerability has been identified in the system BIOS for certain HP Workstation PCs, which might allow escalation of prCVE-2023-61396.5The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thingCVE-2023-61408.8The Essential Real Estate WordPress plugin before 4.4.0 does not prevent users with limited privileges on the site, like subscribers, from mCVE-2023-61415.4The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other thingCVE-2023-61425.4Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker CVE-2023-61438.4Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, ArmCVE-2023-61444.8Dev blog v1.0 allows to exploit an account takeover through the "user" cookie. With this, an attacker can access any user's session just by CVE-2023-61459.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in İstanbul Soft Informatics and ConsultaCVE-2023-61465.4A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of log
CVE-2023-6134: Medium severity, CVSS 5.4 | Vulnix