CVE-2024-12369
Elytron-oidc-client: oidc authorization code injection
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Elytron-oidc-client: oidc authorization code injection
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
Reserved 2024-12-09 | Published 2024-12-09 | Updated 2024-12-19 | Assigner redhatInsufficient Verification of Data Authenticity
| 2024-12-09: | Reported to Red Hat. |
| 2024-12-09: | Made public. |
This issue was discovered by Olivier Rivat (Red Hat).
access.redhat.com/security/cve/CVE-2024-12369
bugzilla.redhat.com/show_bug.cgi?id=2331178 (RHBZ#2331178)
Support options
