Skip to content
fr Sign in
6.8 Medium

CVE-2022-3916 A flaw was found in the offline_access scope in Keycloak

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

Affected products and versions

Product Affected versions Fixed in
Red Hat Single Sign-On 7 Versions not published
Red Hat Single Sign-On 7.6.1 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-20 7.6-20

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Single Sign-On 7

The 285 CVEs of Red Hat Single Sign-On 7 →
CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 High CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 High CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Medium CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High
Track this CVE