{"id":"CVE-2024-12369","state":"PUBLISHED","title":"Elytron-oidc-client: oidc authorization code injection","description":"A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.","publishedAt":"2024-12-09T20:53:09.260Z","updatedAt":"2026-08-04T13:38:06.291Z","severity":{"score":4.2,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["wildfly","Red Hat Red Hat JBoss Enterprise Application Platform 8","Red Hat Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","Red Hat Red Hat Build of Keycloak","Red Hat Red Hat JBoss Enterprise Application Platform 7"],"affected":[{"packageName":"wildfly","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"34.0.1.Final","versionType":"semver"}],"collectionURL":"https://github.com/wildfly/wildfly"},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.wildfly/wildfly-elytron-oidc-client-subsystem","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-apache-commons-io","defaultStatus":"affected","versions":[{"version":"0:2.16.1-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-bouncycastle","defaultStatus":"affected","versions":[{"version":"0:1.80.0-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-eap-product-conf-parent","defaultStatus":"affected","versions":[{"version":"0:800.7.0-2.GA_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-hibernate","defaultStatus":"affected","versions":[{"version":"0:6.2.35-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-ironjacamar","defaultStatus":"affected","versions":[{"version":"0:3.0.13-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-jakarta-enterprise-concurrent","defaultStatus":"affected","versions":[{"version":"0:3.0.1-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-jsf-impl","defaultStatus":"affected","versions":[{"version":"0:4.0.11-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-reactive-streams","defaultStatus":"affected","versions":[{"version":"0:1.0.4-3.redhat_00004.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-reactivex-rxjava","defaultStatus":"affected","versions":[{"version":"0:3.1.10-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-weld-core","defaultStatus":"affected","versions":[{"version":"0:5.1.5-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly","defaultStatus":"affected","versions":[{"version":"0:8.0.7-3.GA_redhat_00004.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:2.2.9-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"wildfly-elytron-oidc-client-subsystem","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"org.wildfly/wildfly-elytron-oidc-client-subsystem","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]}],"references":["https://access.redhat.com/errata/RHSA-2025:3989","https://access.redhat.com/errata/RHSA-2025:3990","https://access.redhat.com/errata/RHSA-2025:3992","https://access.redhat.com/security/cve/CVE-2024-12369","https://bugzilla.redhat.com/show_bug.cgi?id=2331178","https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb","https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb","https://github.com/wildfly-security/wildfly-elytron/pull/2253","https://github.com/wildfly-security/wildfly-elytron/pull/2261"],"weaknesses":["CWE-345"],"ingestedAt":"2026-10-29T20:06:50.777Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/12xxx/CVE-2024-12369.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-12369","state":"PUBLISHED","datePublished":"2024-12-09T20:53:09.260Z","dateUpdated":"2026-08-04T13:38:06.291Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2024-12-09T16:33:36.277Z"},"containers":{"cna":{"title":"Elytron-oidc-client: oidc authorization code injection","descriptions":[{"lang":"en","value":"A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack."}],"affected":[{"packageName":"wildfly","defaultStatus":"unknown","versions":[{"version":"0","status":"affected","lessThanOrEqual":"34.0.1.Final","versionType":"semver"}],"collectionURL":"https://github.com/wildfly/wildfly"},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8","packageName":"org.wildfly/wildfly-elytron-oidc-client-subsystem","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-apache-commons-io","defaultStatus":"affected","versions":[{"version":"0:2.16.1-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-bouncycastle","defaultStatus":"affected","versions":[{"version":"0:1.80.0-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-eap-product-conf-parent","defaultStatus":"affected","versions":[{"version":"0:800.7.0-2.GA_redhat_00002.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-hibernate","defaultStatus":"affected","versions":[{"version":"0:6.2.35-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-ironjacamar","defaultStatus":"affected","versions":[{"version":"0:3.0.13-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-jakarta-enterprise-concurrent","defaultStatus":"affected","versions":[{"version":"0:3.0.1-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-jsf-impl","defaultStatus":"affected","versions":[{"version":"0:4.0.11-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-reactive-streams","defaultStatus":"affected","versions":[{"version":"0:1.0.4-3.redhat_00004.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-reactivex-rxjava","defaultStatus":"affected","versions":[{"version":"0:3.1.10-1.redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-weld-core","defaultStatus":"affected","versions":[{"version":"0:5.1.5-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly","defaultStatus":"affected","versions":[{"version":"0:8.0.7-3.GA_redhat_00004.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8","packageName":"eap8-wildfly-elytron","defaultStatus":"affected","versions":[{"version":"0:2.2.9-1.Final_redhat_00001.1.el8eap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8"]},{"vendor":"Red Hat","product":"Red Hat Build of Keycloak","packageName":"wildfly-elytron-oidc-client-subsystem","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:build_keycloak:"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform 7","packageName":"org.wildfly/wildfly-elytron-oidc-client-subsystem","defaultStatus":"affected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","cpes":["cpe:/a:redhat:jboss_enterprise_application_platform:7"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:3989","name":"RHSA-2025:3989","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3990","name":"RHSA-2025:3990","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2025:3992","name":"RHSA-2025:3992","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-12369","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331178","name":"RHBZ#2331178","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb"},{"url":"https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb"},{"url":"https://github.com/wildfly-security/wildfly-elytron/pull/2253"},{"url":"https://github.com/wildfly-security/wildfly-elytron/pull/2261"}],"metrics":[{"other":{"content":{"value":"Moderate","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.2,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-345","description":"Insufficient Verification of Data Authenticity","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-08-04T13:38:06.291Z"},"datePublic":"2024-12-09T00:00:00.000Z","x_redhatCweChain":"CWE-345: Insufficient Verification of Data Authenticity","workarounds":[{"lang":"en","value":"Currently, no mitigation is currently available for this vulnerability."}],"timeline":[{"lang":"en","time":"2024-12-09T16:26:06.388Z","value":"Reported to Red Hat."},{"lang":"en","time":"2024-12-09T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Olivier Rivat (Red Hat)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-12-10T15:29:39.382723Z","id":"CVE-2024-12369","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-12-10T15:29:50.674Z"}}]}}}