CVE-2022-3916

mediumPriorität · verfolgen · 27EPSS 0.010 · 61. PerzentilDEEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.95% (61st) EPSS

CVSS 6.8 · medium

Is it mine?

22 products

Prüfe deine Angriffsfläche

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · nvd

EPSS · bewertet 2026-10-27

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nprimary · NVD / NIST USAusnutzbarkeit 1.6 · Auswirkung 5.2

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · secalert@redhat.com USAusnutzbarkeit 1.6 · Auswirkung 5.2

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Nsecondary · OSV

v3.16.2mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-613USprimärCWE-287USCWE-304USCWE-384USCWE-488USCWE-613US

betroffene Produkte (22)

Betroffene Produkte und Versionsbereiche.

Open Source Keycloakalle Versionencert_bundDEcpe:/a:keycloak:keycloak:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat RHEL-8 based Middleware Containers< 7.6-15enisa_euvdEU
Red Hat RHEL-8 based Middleware Containers< 7.6-20enisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7< 0:18.0.3-1.redhat_00002.1.el7ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7< 0:18.0.6-1.redhat_00001.1.el7ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8< 0:18.0.3-1.redhat_00002.1.el8ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8< 0:18.0.6-1.redhat_00001.1.el8ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9< 0:18.0.3-1.redhat_00002.1.el9ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9< 0:18.0.6-1.redhat_00001.1.el9ssoenisa_euvdEU
redhat keycloak< 20.0.2nvdUScpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
redhat openshift container platform= 4.10nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhat openshift container platform= 4.9nvdUScpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhat openshift container platform for linuxone= 4.10nvdUScpe:2.3:a:redhat:openshift_container_platform_for_linuxone:*:*:*:*:*:*:*:*
redhat openshift container platform for linuxone= 4.9nvdUScpe:2.3:a:redhat:openshift_container_platform_for_linuxone:*:*:*:*:*:*:*:*
redhat openshift container platform for power= 4.10nvdUScpe:2.3:a:redhat:openshift_container_platform_for_power:*:*:*:*:*:*:*:*
redhat openshift container platform for power= 4.9nvdUScpe:2.3:a:redhat:openshift_container_platform_for_power:*:*:*:*:*:*:*:*
redhat openshift container platform ibm z systems= 4.10nvdUScpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:*:*:*:*:*:*:*:*
redhat openshift container platform ibm z systems= 4.9nvdUScpe:2.3:a:redhat:openshift_container_platform_ibm_z_systems:*:*:*:*:*:*:*:*
redhat single sign-onalle VersionennvdUScpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*

20 von 22 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

WID-SEC-W-2022-2009Keycloak: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2022-11-09csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
GHSA-97g8-xfvw-q4hgKeycloak vulnerable to session takeover with OIDC offline refreshtokens2022-12-13ghsa · osvUS
An issue was discovered in Keycloak when using a client with the `offline_access` scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user. This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the `offline_access` scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd cert_bund nvd osv NVD CVE.org MITRE

veröffentlicht 2023-09-20geändert 2026-06-17

verwandt (733)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2014-2595US	critical9.8	16.9% (97th)	Exploit	2020-02-12
Barracuda Web Application Firewall (WAF) 7.8.1.013 allows remote attackers to bypass authentication by leveraging a permanent authentication token obtained from a query string.
CVE-2020-27422US	critical9.8	7.86% (95th)	Exploit	2020-11-16
In Anuko Time Tracker v1.19.23.5311, the password reset link emailed to the user doesn't expire once used, allowing an attacker to use the same link to takeover the account.
CVE-2021-24019US	critical9.8	3.90% (90th)	Exploit	2021-10-06
An insufficient session expiration vulnerability [CWE- 613] in FortiClientEMS versions 6.4.2 and below, 6.2.8 and below may allow an attacker to reuse the unexpired admin user sess…
CVE-2020-29667US	critical9.8	3.23% (88th)	Exploit	2020-12-10
In Lan ATMService M3 ATM Monitoring System 6.1.0, a remote attacker able to use a default cookie value, such as PHPSESSID=LANIT-IMANAGER, can achieve control over the system becaus…
CVE-2017-6529US	high8.8	2.90% (87th)	Exploit	2017-03-09
An issue was discovered in dnaTools dnaLIMS 4-2015s13. dnaLIMS is vulnerable to session hijacking by guessing the UID parameter.

+728 weitere

Referenzen (40)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan