Vulnerabilities
Misconfiguration
Compliance
CVE Vulnerabilities

CVE-2024-4540

Cleartext Storage of Sensitive Information

Published: Jun 03, 2024 | Modified: Feb 25, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
7.5 LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Ubuntu
Vulnerability-free packages from our partners
root.io logo minimus.io logo echo.ai logo
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2024-4540
CWEhttps://cwe.mitre.org/data/definitions/312.html

A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization servers HTTP response to a request_uri authorization request, possibly leading to an information disclosure vulnerability.

Weakness

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Affected Software

NameVendorStart VersionEnd Version
Red Hat Build of KeycloakRedHat*
Red Hat Build of KeycloakRedHat*
Red Hat build of Keycloak 22RedHatrhbk/keycloak-operator-bundle:22.0.11-2*
Red Hat build of Keycloak 22RedHatrhbk/keycloak-rhel9:22-15*
Red Hat build of Keycloak 22RedHatrhbk/keycloak-rhel9-operator:22-18*
Red Hat build of Keycloak 24RedHatrhbk/keycloak-operator-bundle:24.0.5-2*
Red Hat build of Keycloak 24RedHatrhbk/keycloak-rhel9:24-10*
Red Hat build of Keycloak 24RedHatrhbk/keycloak-rhel9-operator:24-10*
Red Hat Single Sign-On 7RedHat*
Red Hat Single Sign-On 7.6 for RHEL 7RedHatrh-sso7-keycloak-0:18.0.14-1.redhat_00001.1.el7sso*
Red Hat Single Sign-On 7.6 for RHEL 8RedHatrh-sso7-keycloak-0:18.0.14-1.redhat_00001.1.el8sso*
Red Hat Single Sign-On 7.6 for RHEL 9RedHatrh-sso7-keycloak-0:18.0.14-1.redhat_00001.1.el9sso*
RHEL-8 based Middleware ContainersRedHatrh-sso-7/sso76-openshift-rhel8:7.6-49*

Potential Mitigations

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use