CVE-2023-1664

A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable.

• CWE-295
• CWE-295

• https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0Issue Tracking, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2182196&comment#0Issue Tracking, Vendor Advisory

Published

May 26, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1655Heap-based Buffer Overflow in GitHub repository gpac/gpac pr…7.8
• CVE-2023-1656Cleartext Transmission of Sensitive Information vulnerabilit…7.5
• CVE-2023-1659Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-1660The AI ChatBot WordPress plugin before 4.4.9 does not have a…6.1
• CVE-2023-1661The Display post meta, term meta, comment meta, and user met…5.4
• CVE-2023-1663Coverity versions prior to 2023.3.2 are vulnerable to forced…5.3
• CVE-2023-1665Improper Restriction of Excessive Authentication Attempts in…9.8
• CVE-2023-1666A vulnerability has been found in SourceCodester Automatic Q…9.8
• CVE-2023-1667A NULL pointer dereference was found In libssh during re-key…6.5
• CVE-2023-1668A flaw was found in openvswitch (OVS). When processing an IP…8.2
• CVE-2023-1669The SEOPress WordPress plugin before 6.5.0.3 unserializes us…7.2
• CVE-2023-1670A flaw use after free in the Linux kernel Xircom 16-bit PCMC…7.8