High severity7.2NVD Advisory· Published Oct 26, 2017· Updated Jun 17, 2026
CVE-2017-12160
CVE-2017-12160
Description
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-parentMaven | < 3.3.0.Final | 3.3.0.Final |
Affected products
3- Red Hat, Inc./keycloakv5Range: 3.4.0
Patches
Vulnerability mechanics
References
6- access.redhat.com/errata/RHSA-2017:2904nvdIssue TrackingThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2905nvdIssue TrackingThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2017:2906nvdIssue TrackingThird Party AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-qc72-gfvw-76h7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2017-12160ghsaADVISORY
News mentions
0No linked articles in our index yet.