Log in Start free

Vulnerability · Published Oct 4, 2023 · Assigned by redhat

CVE-2023-1584Quarkus-oidc: id and access tokens leak via the authorization code flow

High 7.5

In plain English

A high-severity information exposure in quarkus-oidc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.0%top 38.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenio.quarkus:quarkus-oidc2.13.0.FinalGHSA-6hc9-cf8x-hf83
Mavenio.quarkus:quarkus-oidc3.1.0.FinalGHSA-6hc9-cf8x-hf83

Affected products (as reported)

VendorProductVersions
quarkus-oidc see references
Red Hat Red Hat build of Quarkus 2.13.8.Final see references
Red Hat RHINT Service Registry 2.5.4 GA see references

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References