Global infos:

A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.

CVE Status: Awaiting Analysis

References:

[email protected]

[email protected]

[email protected]

[email protected]

Metrics:

Attribute	Value
Attack Complexity	HIGH
Attack Vector	ADJACENT_NETWORK
Availability Impact	NONE
Base Score	3.4
Base Severity	LOW
Confidentiality Impact	LOW
Integrity Impact	LOW
Privileges Required	LOW
Scope	UNCHANGED
User Interaction	REQUIRED
Vector String	CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Exploitability Score	0.9
Impact Score	2.5
Source	[email protected]
Type	Primary

Links:

Exploit-db
Github