{"id":"CVE-2024-4540","revision":"f49939f5e8e64758b266fd1bcda6d030","records":[{"revision":"f49939f5e8e64758b266fd1bcda6d030","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-4540","aliases":[],"title":"Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie","description":"A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability.","state":0,"publishedAt":"2024-06-03T15:33:18.191+00:00","modifiedAt":"2026-10-09T16:43:28.495+00:00","affected":[{"ecosystem":"https://github.com/keycloak/keycloak","name":"keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"repo\": \"https://github.com/keycloak/keycloak\",\n                    \"versions\": [\n                        {\n                            \"status\": \"unaffected\",\n                            \"version\": \"d5e82356f90893ca3b308a7e10020103e402369a\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"git\"\n                        }\n                    ],\n                    \"packageName\": \"keycloak\",\n                    \"collectionURL\": \"https://github.com/keycloak/keycloak\"\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"Red Hat Build of Keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Build of Keycloak\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:22\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"Red Hat Build of Keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Build of Keycloak\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 22\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"22.0.11-2\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:22::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 22\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"22-15\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:22::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 22\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"22-18\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:22::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-operator-bundle","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-operator-bundle\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24.0.5-2\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24-10\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rhbk/keycloak-rhel9-operator","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat build of Keycloak 24\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rhbk/keycloak-rhel9-operator\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"24-10\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:build_keycloak:24::el9\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"Red Hat Single Sign-On 7","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7.6\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rh-sso7-keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7.6 for RHEL 7\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rh-sso7-keycloak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:18.0.14-1.redhat_00001.1.el7sso\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7.6::el7\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rh-sso7-keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7.6 for RHEL 8\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rh-sso7-keycloak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:18.0.14-1.redhat_00001.1.el8sso\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7.6::el8\"\n                    ]\n                }"},{"ecosystem":"https://access.redhat.com/downloads/content/package-browser/","name":"rh-sso7-keycloak","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"Red Hat Single Sign-On 7.6 for RHEL 9\",\n                    \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\",\n                    \"packageName\": \"rh-sso7-keycloak\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0:18.0.14-1.redhat_00001.1.el9sso\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:red_hat_single_sign_on:7.6::el9\"\n                    ]\n                }"},{"ecosystem":"https://catalog.redhat.com/software/containers/","name":"rh-sso-7/sso76-openshift-rhel8","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Red Hat\",\n                    \"product\": \"RHEL-8 based Middleware Containers\",\n                    \"collectionURL\": \"https://catalog.redhat.com/software/containers/\",\n                    \"packageName\": \"rh-sso-7/sso76-openshift-rhel8\",\n                    \"defaultStatus\": \"affected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"7.6-49\",\n                            \"lessThan\": \"*\",\n                            \"versionType\": \"rpm\",\n                            \"status\": \"unaffected\"\n                        }\n                    ],\n                    \"cpes\": [\n                        \"cpe:/a:redhat:rhosemc:1.0::el8\"\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://access.redhat.com/errata/RHSA-2024:3566","https://access.redhat.com/errata/RHSA-2024:3567","https://access.redhat.com/errata/RHSA-2024:3568","https://access.redhat.com/errata/RHSA-2024:3570","https://access.redhat.com/errata/RHSA-2024:3572","https://access.redhat.com/errata/RHSA-2024:3573","https://access.redhat.com/errata/RHSA-2024:3574","https://access.redhat.com/errata/RHSA-2024:3575","https://access.redhat.com/errata/RHSA-2024:3576","https://access.redhat.com/security/cve/CVE-2024-4540","https://bugzilla.redhat.com/show_bug.cgi?id=2279303"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-4540","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-4540","identifiers":["CVE-2024-4540"]},"retained":false,"historicalAffected":[]}],"coverage":[]}