CVE-2024-12369

Elytron-oidc-client: oidc authorization code injection

State: Published
Severity: 4.2 Medium
Published: Dec 9, 2024
Updated: Aug 4, 2026
Reserved: Dec 9, 2024

Description

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

Scores

CVSS	Score	Vector	Source
3.1	4.2 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N	redhat

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
wildfly	34.0.1.Final and earlierAffected
Red Hat JBoss Enterprise Application Platform 8Red Hat
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.16.1-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.80.0-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:800.7.0-2.GA_redhat_00002.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:6.2.35-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.0.13-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.0.1-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:4.0.11-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:1.0.4-3.redhat_00004.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:3.1.10-1.redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:5.1.5-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:8.0.7-3.GA_redhat_00004.1.el8eap and laterNot affected
Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Red Hat	0:2.2.9-1.Final_redhat_00001.1.el8eap and laterNot affected
Red Hat Build of KeycloakRed Hat
Red Hat JBoss Enterprise Application Platform 7Red Hat

References

RHSA-2025:3989vendor-advisory
RHSA-2025:3990vendor-advisory
RHSA-2025:3992vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-12369vdb-entry
RHBZ#2331178issue-tracking
https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb
https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb
https://github.com/wildfly-security/wildfly-elytron/pull/2253
https://github.com/wildfly-security/wildfly-elytron/pull/2261

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.