Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2022-3916 A flaw was found in the offline_access scope in Keycloak

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Single Sign-On 7 Versions non publiées
Red Hat Single Sign-On 7.6.1 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 7 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 8 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 9 Versions non publiées
RHEL-8 based Middleware Containers 7.6 premières → < 7.6-20 7.6-20

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Single Sign-On 7

Les 294 CVE de Red Hat Single Sign-On 7 →
CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Moyenne CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Moyenne CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles 6.5 Moyenne CVE-2026-96460 Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2 5.4 Moyenne
Suivre cette CVE