Keycloak vulnerable to session takeover with OIDC offline refreshtokens
An issue was discovered in Keycloak when using a client with the `offline_access` scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user. This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the `offline_access` scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-3916US | medium6.8 | — | ||
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root sess… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2022:8961WEB
- https://access.redhat.com/errata/RHSA-2022:8962WEB
- https://access.redhat.com/errata/RHSA-2022:8963WEB
- https://access.redhat.com/errata/RHSA-2022:8964WEB
- https://access.redhat.com/errata/RHSA-2022:8965WEB
- https://access.redhat.com/errata/RHSA-2023:1043WEB
- https://access.redhat.com/errata/RHSA-2023:1044WEB
- https://access.redhat.com/errata/RHSA-2023:1045WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan