CVE-2022-3916 — Keycloak: session takeover with oidc offline refreshtokens

Description (CNA)

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

Affected (CNA)

Vendor / product	Versions
Red Hat / Red Hat Single Sign-On 7	unaffected
Red Hat / Red Hat Single Sign-On 7.6.1	unaffected
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7	unaffected 0:18.0.3-1.redhat_00002.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 7	unaffected 0:18.0.6-1.redhat_00001.1.el7sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8	unaffected 0:18.0.3-1.redhat_00002.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 8	unaffected 0:18.0.6-1.redhat_00001.1.el8sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9	unaffected 0:18.0.3-1.redhat_00002.1.el9sso before *
Red Hat / Red Hat Single Sign-On 7.6 for RHEL 9	unaffected 0:18.0.6-1.redhat_00001.1.el9sso before *
Red Hat / RHEL-8 based Middleware Containers	unaffected 7.6-15 before *
Red Hat / RHEL-8 based Middleware Containers	unaffected 7.6-20 before *

CWE

CWE-384

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.