Riskcovery

CVE-2022-3916

Keycloak: session takeover with oidc offline refreshtokens

State
Published
Severity
6.8 Medium
Published
Sep 20, 2023
Updated
Aug 3, 2024
Reserved
Nov 9, 2022

Read the record on cve.org

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

Scores

CVSSScoreVectorSource
3.16.8 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nredhat

Weaknesses

Affected Products

ProductVersions
Red Hat Single Sign-On 7Red Hat
    Red Hat Single Sign-On 7.6.1Red Hat
      Red Hat Single Sign-On 7.6 for RHEL 7Red Hat
      • 0:18.0.3-1.redhat_00002.1.el7sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 7Red Hat
      • 0:18.0.6-1.redhat_00001.1.el7sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 8Red Hat
      • 0:18.0.3-1.redhat_00002.1.el8sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 8Red Hat
      • 0:18.0.6-1.redhat_00001.1.el8sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 9Red Hat
      • 0:18.0.3-1.redhat_00002.1.el9sso and laterNot affected
      Red Hat Single Sign-On 7.6 for RHEL 9Red Hat
      • 0:18.0.6-1.redhat_00001.1.el9sso and laterNot affected
      RHEL-8 based Middleware ContainersRed Hat
      • 7.6-15 and laterNot affected
      RHEL-8 based Middleware ContainersRed Hat
      • 7.6-20 and laterNot affected

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.