Published: 04/10/2023 Updated: 21/11/2024

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow malicious users to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

Vulnerable Product	Search on Vulmon	Subscribe to Product
quarkus quarkus

Synopsis Important: Service Registry (container images) release and security update [254 GA] Type/Severity Security Advisory: Important Topic An update to the images for Red Hat Integration - Service Registry is now available from the Red Hat Container Catalog The purpose of this text-only errata is to inform you about the security issues ...

Synopsis Moderate: Red Hat build of Quarkus 2138 release and security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat build of Quarkus Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a d ...

DescriptionA flaw was found in Quarkus Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services Please note that passwo ...

https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:7653 https://access.redhat.com/security/cve/cve-2023-1584

CVE-2023-1584

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect