GitHub Advisoryadvisory · Maven

GHSA-97g8-xfvw-q4hg Keycloak vulnerable to session takeover with OIDC offline refreshtokens

MEDIUM Published 2022-12-13 Modified 2023-09-20 Official page ↗
Aliases
CVE-2022-3916
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287, CWE-304, CWE-488, CWE-613
Reviewed
2022-12-13

Affected packages

• Maven org.keycloak:keycloak-parent: < 20.0.2 → fixed in 20.0.2

Description

An issue was discovered in Keycloak when using a client with the `offline_access` scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user. This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the `offline_access` scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2022-3916 A flaw was found in the offline_access scope in Keycloak. vulnerability

Weakness · CWE (3)

  • CWE-287 Improper Authentication weakness
  • CWE-304 Missing Critical Step in Authentication weakness
  • CWE-488 Exposure of Data Element to Wrong Session weakness

References