{"id":"CVE-2023-6927","aliases":["GHSA-9vm7-v8wj-3fqw"],"url":"https://o3.security/vulnerability/CVE-2023-6927","summary":"Keycloak: open redirect via \"form_post.jwt\" jarm response mode","details":"A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode \"form_post.jwt\" which could be used to bypass the security patch implemented to address CVE-2023-6134.","published":"2023-12-18T22:59:07.495Z","modified":"2026-08-12T03:51:37.351302502Z","cvss":{"score":4.6,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.keycloak:keycloak-core","fixedVersion":"23.0.4"}],"fix":null,"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://catalog.redhat.com/software/containers/"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0094"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0095"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0096"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0097"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0098"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0101"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0798"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0799"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0800"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0801"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0804"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-6927"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6927.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6927"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255027"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.351302502Z"}}