CVE-2022-3916: Keycloak: session takeover with oidc offline refreshtokens
A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
Other sources
An issue was discovered in Keycloak when using a client with the offlineaccess scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.
This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offlineaccess scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
An issue was discovered in Keycloak when using a client with the offlineaccess scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.
This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offlineaccess scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-3916?
CVE-2022-3916 is a vulnerability in Keycloak that allows attackers to resolve a user session attached to a different previously authenticated user.
What is the severity of CVE-2022-3916?
CVE-2022-3916 has a severity rating of 6.8 (medium).
How does CVE-2022-3916 affect Keycloak users?
CVE-2022-3916 affects Keycloak users who are using a client with the `offline_access` scope.
How can I fix CVE-2022-3916?
To fix CVE-2022-3916, users should apply the recommended patch or upgrade their Keycloak version to 20.0.2.
Where can I find more information about CVE-2022-3916?
More information about CVE-2022-3916 can be found on the CVE website (https://www.cve.org/CVERecord?id=CVE-2022-3916) and the NIST NVD (https://nvd.nist.gov/vuln/detail/CVE-2022-3916).