MEDIUMCVSS 5.3EPSS 1.0%

CVE-2023-6484

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

Published: 2024-04-17
Modified: 2026-07-21
EPSS percentile: 59%
Aliases: GHSA-j628-q885-8gr5
Sources: github-advisory

Summary

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Maven	org.keycloak:keycloak-services	—	22.0.9, 23.0.5

Remediation: Upgrade to 22.0.9 or later.

References

https://github.com/advisories/GHSA-j628-q885-8gr5

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.