A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2024-06-03T15:33:18.191Z
Updated: 2024-09-18T08:37:31.443Z
Reserved: 2024-05-06T11:02:39.841Z
Link: CVE-2024-4540
Vulnrichment
Updated: 2024-08-01T20:40:47.507Z
NVD
Status : Awaiting Analysis
Published: 2024-06-03T16:15:08.993
Modified: 2024-06-03T23:15:08.930
Link: CVE-2024-4540
Redhat