CVE-2023-2422 (published 2023-10-04T10:59:30.818Z)
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
Affected products: Vendor: n/a
Product: keycloak
Versions: 18.0