Количество 4
Количество 4
CVE-2022-3916
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
CVE-2022-3916
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
CVE-2022-3916
A flaw was found in the offline_access scope in Keycloak. This issue w ...
GHSA-97g8-xfvw-q4hg
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2022-3916 A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user. | CVSS3: 6.8 | 0% Низкий | около 3 лет назад |
 | CVE-2022-3916 A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user. | CVSS3: 6.8 | 0% Низкий | больше 2 лет назад |
| CVE-2022-3916 A flaw was found in the offline_access scope in Keycloak. This issue w ... | CVSS3: 6.8 | 0% Низкий | больше 2 лет назад |
| GHSA-97g8-xfvw-q4hg Keycloak vulnerable to session takeover with OIDC offline refreshtokens | CVSS3: 6.8 | 0% Низкий | около 3 лет назад |
Уязвимостей на страницу