VYPR
← All advisories
Medium severity6.8NVD Advisory· Published Sep 20, 2023· Updated Jun 17, 2026

CVE-2022-3916

CVE-2022-3916

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-parentMaven
< 20.0.220.0.2

Affected products

18
  • Red Hat/Single Sign Oncpe-rescue7 versions
    cpe:/a:redhat:red_hat_single_sign_on:7.6+ 6 more
    • cpe:/a:redhat:red_hat_single_sign_on:7.6
    • cpe:/a:redhat:red_hat_single_sign_on:7.6.1
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el7range: 0:18.0.6-1.redhat_00001.1.el7sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el8range: 0:18.0.6-1.redhat_00001.1.el8sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el9range: 0:18.0.6-1.redhat_00001.1.el9sso
    • cpe:2.3:a:redhat:single_sign-on:-:*:*:*:text-only:*:*:*
    • cpe:2.3:a:redhat:single_sign-on:7.6:*:*:*:*:*:*:*
  • Red Hat/RHEL-8 based Middleware Containersv5
    cpe:/a:redhat:rhosemc:1.0::el8
    Range: 7.6-20
  • Red Hat/Keycloak
    cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
    Range: <20.0.2
  • Red Hat/Openshift Container Platform4 versions
    cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_power:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform For Linuxone2 versions
    cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.9:*:*:*:*:*:*:*
  • Red Hat/Openshift Container Platform Ibm Z Systems2 versions
    cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.10:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:4.9:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-parent
    Range: < 20.0.2

Patches

Vulnerability mechanics

References

15

News mentions

0

No linked articles in our index yet.