CVE-2017-12160

HIGH

Keycloak 0-3.3.0.Final and 3.4.0 - Authenticated Improper Authorization via OAuth Token Pair

Title source: llm
STIX 2.1

Description

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.

References (4)

Core 4
Core References
Issue Tracking, Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2904
Issue Tracking, Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2905
Issue Tracking, Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2906
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1484154

Scores

CVSS v3 7.2
EPSS 0.0057
EPSS Percentile 68.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-285 CWE-287
Status published
Products (3)
org.keycloak/keycloak-parent 0 - 3.3.0.FinalMaven
Red Hat, Inc./keycloak 3.4.0
redhat/keycloak
Published Oct 26, 2017
Tracked Since Feb 18, 2026