The vulnerability in Red Hat Build of Keycloak's PAR implementation occurs due to a logic error in the silent authentication flow (prompt=none), which skips the consumption and deletion of pushed authorization request URIs. This flaw allows replaying a pushed request URI multiple times to obtain several valid authorization codes for a user already signed in. The issue violates the security principle that each pushed request URI should be single-use, potentially undermining authorization security. Red Hat rates this vulnerability as Moderate with a CVSS 3.1 score of 4.2, noting that exploitation requires low privileges but high attack complexity and no user interaction. No patch or mitigation meeting Red Hat's standards is currently available.

An attacker with an existing SSO session and valid client credentials can replay a pushed authorization request URI multiple times to obtain multiple valid authorization codes for a logged-in user. This compromises the intended single-use enforcement of authorization request URIs, violating security standards like FAPI-2. The impact includes potential unauthorized access to authorization codes, which may lead to limited confidentiality and integrity breaches. The vulnerability does not affect availability.

According to the Red Hat advisory, no mitigation or patch currently meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat's advisory page for updates. Since exploitation requires an existing SSO session and valid client credentials, limiting exposure of such credentials and sessions may reduce risk. Engage with Red Hat support or a Technical Account Manager for tailored guidance. No official fix is available at this time.