A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2022:8961 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2022:8962 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2022:8963 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2022:8964 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2022:8965 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:1043 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:1044 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:1045 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:1047 | Vendor Advisory |
https://access.redhat.com/errata/RHSA-2023:1049 | Vendor Advisory |
https://access.redhat.com/security/cve/CVE-2022-3916 | Vendor Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2141404 | Issue Tracking Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2023-09-20T14:28:52.089Z
Updated: 2024-05-03T15:32:25.617Z
Reserved: 2022-11-09T16:12:41.804Z
Link: CVE-2022-3916
JSON object: View
NVD Information
Status : Modified
Published: 2023-09-20T15:15:11.583
Modified: 2023-11-07T03:51:57.670
Link: CVE-2022-3916
JSON object: View
Redhat Information
No data.