Untriaged
Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Affected products
keycloak
- *
keycloak-core
rh-sso7-keycloak
- *
rhbk/keycloak-rhel9
- *
Red Hat Single Sign-On 7
Red Hat Build of Keycloak
rhbk/keycloak-rhel9-operator
- *
rhbk/keycloak-operator-bundle
- *
rh-sso-7/sso76-openshift-rhel8
- *
Matching in nixpkgs
pkgs.keycloak
Identity and access management for modern applications and services
-
nixos-unstable -
- nixpkgs-unstable 26.3.4
pkgs.terraform-providers.keycloak
None
-
nixos-unstable -
- nixpkgs-unstable 5.4.0
pkgs.python312Packages.python-keycloak
Provides access to the Keycloak API
-
nixos-unstable -
- nixpkgs-unstable 4.0.0
pkgs.python313Packages.python-keycloak
Provides access to the Keycloak API
-
nixos-unstable -
- nixpkgs-unstable 4.0.0
Package maintainers
-
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@talyz Kim Lindberger <kim.lindberger@gmail.com>
-
@leona-ya Leona Maroni <nix@leona.is>