4.2
Medium
CVE-2024-12369 A vulnerability was found in OIDC-Client
Description
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | Versions not published | |
| Red Hat Build of Keycloak | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 7 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8 | Versions not published | |
| Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | Versions not published |
References
- RHSA-2025:3989 access.redhat.com
- RHSA-2025:3990 access.redhat.com
- RHSA-2025:3992 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2331178 bugzilla.redhat.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
The 18 CVEs of Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 →
CVE-2025-12543
Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf
9.6
Critical
CVE-2024-3884
Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded
High
CVE-2025-9784
Undertow: undertow madeyoureset http/2 ddos vulnerability
7.5
High
CVE-2025-2251
A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans…
6.2
Medium