pentester.land· Apr 14, 2023· by Jordi Zayuelas i Muñoz🔍 CVE-2023-0264

User impersonation via stolen UUID code in KeyCloak (CVE-2023-0264)

Target Program: Keycloak

🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass

💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.

#OAuth#OIDC#Privilege escalation#Broken authentication#CVE-2023-0264