Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS05N2c4LXhmdnctcTRoZ84AAwUZ

Keycloak vulnerable to session takeover with OIDC offline refreshtokens

An issue was discovered in Keycloak when using a client with the offline_access scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.

This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offline_access scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.

Permalink: https://github.com/advisories/GHSA-97g8-xfvw-q4hg
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS05N2c4LXhmdnctcTRoZ84AAwUZ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 6 months ago
Updated: 5 months ago

Identifiers: GHSA-97g8-xfvw-q4hg, CVE-2022-3916
References:

• https://github.com/keycloak/keycloak/security/advisories/GHSA-97g8-xfvw-q4hg
• https://github.com/advisories/GHSA-97g8-xfvw-q4hg

Affected Packages