CVE-2024-4540 – This vulnerability in Keycloak's OAuth 2.0 Push... (How to Fix)

Q: What is the severity of CVE-2024-4540?

CVE-2024-4540 has a CVSS score of 7.5 (HIGH). This vulnerability in Keycloak's OAuth 2.0 Pushed Authorization Requests (PAR) feature exposes client-provided parameters in plain text within the KC_RESTART cookie. This information disclosure could allow attackers to access sensitive data from authorization requests. Organizations using Keycloak with PAR enabled are affected.

📋 TL;DR

This vulnerability in Keycloak's OAuth 2.0 Pushed Authorization Requests (PAR) feature exposes client-provided parameters in plain text within the KC_RESTART cookie. This information disclosure could allow attackers to access sensitive data from authorization requests. Organizations using Keycloak with PAR enabled are affected.

💻 Affected Systems

Products:

Keycloak

Versions: Specific versions mentioned in Red Hat advisories (check RHSA-2024:3566 through RHSA-2024:3572)

Operating Systems: All platforms running Keycloak

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects configurations using OAuth 2.0 Pushed Authorization Requests (PAR) feature

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could intercept sensitive client parameters (potentially including credentials, tokens, or other authentication data) leading to account compromise or further attacks.

🟠

Likely Case

Information disclosure of client parameters used in OAuth flows, potentially exposing session data or configuration details.

🟢

If Mitigated

With proper network controls and patching, the risk is limited to internal information disclosure with minimal impact.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires ability to intercept HTTP responses containing the KC_RESTART cookie

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for patched versions

Vendor Advisory: https://access.redhat.com/errata/RHSA-2024:3566

Restart Required: Yes

Instructions:

1. Review Red Hat advisories RHSA-2024:3566 through RHSA-2024:3572. 2. Identify applicable patch for your Keycloak version. 3. Apply the security update. 4. Restart Keycloak service.

🔧 Temporary Workarounds

Disable PAR feature

all

Temporarily disable OAuth 2.0 Pushed Authorization Requests if not required

Configure Keycloak to disable PAR in realm settings

🧯 If You Can't Patch

Implement strict network segmentation to limit access to Keycloak instances
Monitor for unusual access patterns to authorization endpoints

🔍 How to Verify

Check if Vulnerable:

Check if using Keycloak with PAR enabled and version matches affected range in Red Hat advisories

Check Version:

Check Keycloak server logs or admin console for version information

Verify Fix Applied:

Verify Keycloak version is updated to patched version from Red Hat advisories

📡 Detection & Monitoring

Log Indicators:

Unusual access patterns to authorization endpoints
Multiple failed PAR requests

Network Indicators:

Interception of KC_RESTART cookies in HTTP responses

SIEM Query:

Search for Keycloak authorization requests with unusual parameters or from unexpected sources

📊 Metadata

CVE ID: CVE-2024-4540

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE: CWE-312

Published: June 3, 2024

Last Updated: February 25, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-4540, you might also want to check these: