VYPR
← All advisories
Moderate severityNVD Advisory· Published Sep 20, 2023· Updated Aug 3, 2024

Keycloak: session takeover with oidc offline refreshtokens

CVE-2022-3916

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.keycloak:keycloak-parentMaven
< 20.0.220.0.2

Affected products

7
  • Red Hat/Single Sign Oncpe-rescue5 versions
    cpe:/a:redhat:red_hat_single_sign_on:7.6+ 4 more
    • cpe:/a:redhat:red_hat_single_sign_on:7.6
    • cpe:/a:redhat:red_hat_single_sign_on:7.6.1
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el7range: 0:18.0.6-1.redhat_00001.1.el7sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el8range: 0:18.0.6-1.redhat_00001.1.el8sso
    • cpe:/a:redhat:red_hat_single_sign_on:7.6::el9range: 0:18.0.6-1.redhat_00001.1.el9sso
  • Red Hat/RHEL-8 based Middleware Containersv5
    cpe:/a:redhat:rhosemc:1.0::el8
    Range: 7.6-20
  • ghsa-coords
    pkg:maven/org.keycloak/keycloak-parent
    Range: < 20.0.2

Patches

Vulnerability mechanics

References

15

News mentions

0

No linked articles in our index yet.