CVE-2023-1584

HIGH

Quarkus < 2.13.8 and quarkus-oidc < 2.13.0.Final - Exposure of Sensitive Information via Insecure HTTP Protocol

Title source: llm
STIX 2.1

Description

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

References (6)

Core 6
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2023:3809
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2023:7653
Third Party Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2023-1584
Issue Tracking, Third Party Advisory issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2180886

Scores

CVSS v3 7.5
EPSS 0.0095
EPSS Percentile 56.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (2)
io.quarkus/quarkus-oidc 0 - 2.13.0.FinalMaven
quarkus/quarkus < 2.13.8
Published Oct 04, 2023
Tracked Since Feb 18, 2026