GitHub Advisoryadvisory · Maven

GHSA-qc72-gfvw-76h7 Keycloak Oauth Implementation Error

HIGH Published 2022-05-13 Modified 2023-10-10 Official page ↗
Aliases
CVE-2017-12160
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2023-07-25

Affected packages

• Maven org.keycloak:keycloak-parent: < 3.3.0.Final → fixed in 3.3.0.Final

Description

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.

Related

Alias · CVE (1)

  • CVE-2017-12160 It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References