VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 20, 2023· Updated Aug 3, 2024

Keycloak: session takeover with oidc offline refreshtokens

CVE-2022-3916

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Keycloak's offline_access scope lacks root session validation, allowing an attacker to reuse a session ID and obtain tokens for a previously authenticated user.

The vulnerability resides in the offline_access scope of Keycloak. The root cause is a lack of root session validation and the reuse of session IDs across root and user authentication sessions. This flaw allows an attacker to resolve a user session that is attached to a previously authenticated user [1][2].

Exploitation is more likely on shared computers, especially if cookies are not cleared. An attacker with access to the same browser or session data can utilize a refresh token to be issued a token for the original user, effectively impersonating them [1][2].

The impact is that an attacker can gain tokens for the original user, potentially accessing resources and performing actions as that user. This constitutes a session fixation or impersonation vulnerability, compromising the confidentiality and integrity of user sessions.

Red Hat has released security updates via RHSA-2023:1045 and RHSA-2023:1044 to address this issue. Users are advised to update their Keycloak installations to the patched versions [3][4].

References
  1. cve-details
  2. NVD - CVE-2022-3916
  3. https://access.redhat.com/errata/RHSA-2023:1045
  4. https://access.redhat.com/errata/RHSA-2023:1044

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-parentMaven
< 20.0.220.0.2

Affected products

7
  • Red Hat/Red Hat Single Sign-On 7v5
    cpe:/a:redhat:red_hat_single_sign_on:7.6
  • Red Hat/Red Hat Single Sign-On 7.6.1v5
    cpe:/a:redhat:red_hat_single_sign_on:7.6.1
  • Red Hat/Red Hat Single Sign-On 7.6 for RHEL 7v5
    cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
    Range: 0:18.0.6-1.redhat_00001.1.el7sso
  • Red Hat/Red Hat Single Sign-On 7.6 for RHEL 8v5
    cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
    Range: 0:18.0.6-1.redhat_00001.1.el8sso
  • Red Hat/Red Hat Single Sign-On 7.6 for RHEL 9v5
    cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
    Range: 0:18.0.6-1.redhat_00001.1.el9sso
  • Red Hat/RHEL-8 based Middleware Containersv5
    cpe:/a:redhat:rhosemc:1.0::el8
    Range: 7.6-20
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-parent
    Range: < 20.0.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

15

News mentions

0

No linked articles in our index yet.