Threats tagged 'ghsa-rp3r-7x6g-5mw6'

A vulnerability in the keycloak-services component of Keycloak allows skipping mandatory Proof Key for Code Exchange (PKCE) security checks when a user initiates login after visiting the password reset page. This flaw enables an attacker who intercepts a login code to exchange it for tokens and impersonate the user without the required PKCE verifier. Exploitation requires the victim to follow a specific sequence of pages and the attacker to intercept the authorization code. No effective mitigation or patch is currently available according to the vendor advisory.