What happened
A flaw has been identified in the OIDC Dynamic Client Registration (DCR) component of Keycloak, where a bug in the response serialization leads to the omission of the backchannel logout offline token revocation setting from responses. This omission causes the setting to be silently disabled during a standard update. Consequently, offline tokens may remain valid even after a user session has been terminated through backchannel logout. The vulnerability stems from a response serialization issue that affects session management and token revocation capabilities.
Who is affected
Organisations running the Red Hat Build of Keycloak are affected by this vulnerability. The issue can be exploited remotely over a network, requiring only low-privileged access, with no user action required. The impact is limited to affected deployments where the exposed service is reachable externally or within internal networks.
Recommended actions
- Restrict network access to the affected service through appropriate network segmentation and access control measures to prevent unauthorised external access.
- Implement security controls to limit access for low-privileged accounts, reducing the attack surface for exploiting the vulnerability.
- Ensure systems are updated to apply relevant security patches when they become available, although no patch link is currently provided.
- Monitor network traffic for unusual activity targeting the service to detect potential exploitation attempts.
Indicators of compromise
At this time, no specific indicators of compromise have been publicly identified or shared regarding this vulnerability.
