High severity7.2NVD Advisory· Published Oct 26, 2017· Updated May 13, 2026
CVE-2017-12160
CVE-2017-12160
Description
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-parentMaven | < 3.3.0.Final | 3.3.0.Final |
Affected products
2- Red Hat, Inc./keycloakv5Range: 3.4.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- access.redhat.com/errata/RHSA-2017:2904nvdIssue TrackingThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2905nvdIssue TrackingThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2906nvdIssue TrackingThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-qc72-gfvw-76h7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-12160ghsaADVISORY
News mentions
0No linked articles in our index yet.