cve.bz

CVE-2023-0091

3.8 lowEPSS 0.5%

Low (3.8) in redhat keycloak. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in org.keycloak:keycloak-core 20.0.3.

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

Severity

CVSS 3.1

3.8 low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
CWE
CWE-863
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-v436-q368-hvggMavenorg.keycloak:keycloak-core<20.0.320.0.3

References

Check your stackJSON