Security readout for executives and security teams
Plain-English summary
Keycloak can incorrectly accept some redirect_uri values, letting an attacker bypass intended host restrictions. If a user is tricked into the affected login flow, an access token could be stolen and used to impersonate that user.
Executive priority
Treat as high priority for internet-facing or business-critical identity systems. Token theft in SSO can become account impersonation across dependent applications, but current sources do not confirm active exploitation.
Technical view
CVE-2023-6291 is a CWE-601 redirect_uri validation bypass in Red Hat Keycloak-related products. The CVSS 3.1 score is 7.1, network exploitable, low complexity, no privileges required, and user interaction required, with scope changed and low confidentiality, integrity, and availability impact.
Likely exposure
Exposure is most likely where affected Red Hat build of Keycloak 22, Red Hat SSO 7.6 packages, RHEL 8 middleware containers, or Migration Toolkit for Applications 6 use Keycloak-based authentication.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. The attack requires user interaction and could lead to access token theft, enabling user impersonation if successful.
Researcher notes
The key evidence is Red Hat's description of redirect_uri validation bypass and access-token theft impact. Affected status is product-specific; several related Red Hat products are explicitly listed as unaffected, so validation should be version- and channel-specific.
Mitigation direction
- Identify deployments matching the affected Red Hat products and package versions.
- Apply the relevant Red Hat RHSA guidance for each affected product stream.
- Check Red Hat CVE guidance for product-specific fixed packages or mitigations.
- Review client redirect URI allowlists for unnecessarily broad trusted hosts.
- Monitor identity-provider logs for suspicious redirects and token use.
Validation and detection
- Inventory Keycloak, Red Hat SSO, and MTA instances by product stream and package version.
- Compare installed package versions against the affected entries in the CVE record.
- Confirm applicable RHSA advisories have been applied in each environment.
- Validate that sensitive clients use narrowly scoped redirect URI allowlists.
- Review recent authentication logs for unexpected redirect destinations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-601: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2023-6291 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L2.83.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2023:7854CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7855CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7856CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7857CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7858CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7860CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2023:7861CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0798CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0799CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0800CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0801CVE reference · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:0804CVE reference · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-6291CVE reference · vdb-entry, x_refsource_REDHAT
- RHBZ#2251407CVE reference · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
URL Redirection to Untrusted Site ('Open Redirect')
URL Redirection to Untrusted Site ('Open Redirect') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.