CVE-2023-2585: Red Hat Openshift Container Platform

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.

Affected products

• Red Hat Openshift Container Platform: version 4.11 only; version 4.12 only
• Red Hat Openshift Container Platform For IBM Z: version 4.9 only; version 4.10 only
• Red Hat Openshift Container Platform For Linuxone: version 4.9 only; version 4.10 only
• Red Hat Openshift Container Platform For Power: version 4.9 only; version 4.10 only
• Red Hat Single Sign-On: version 7.6 only; affected versions not specified

Published 2023-12-21. Last modified 2026-06-17.