-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from improper client validation during device_code usage. The commit shows: (1) DeviceGrantType.getDeviceByDeviceCode originally lacked client-ID validation (added in the patch), allowing cross-client device_code reuse. (2) CibaGrantType.cibaGrant had a client check that was removed because the validation was centralized into DeviceGrantType.getDeviceByDeviceCode. The high-confidence entry reflects the core missing security check, while the medium-confidence entry highlights a related architectural flaw.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 21.1.2 | 21.1.2 |
| org.keycloak:keycloak-server-spi-private | maven | < 21.1.2 | 21.1.2 |