CVE-2022-1245: redhat keycloak Missing Authorization

Vulnerability summary

CVE-2022-1245 is a critical (CVSS 9.8) Missing Authorization vulnerability in redhat keycloak. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.4% of scored vulnerabilities.

Timeline

1. 07-07-2022
   PublishedVulnerability first disclosed.
2. 02-08-2024
   Last modifiedVulnerability information updated.

Description

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
• CWE-639Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.