title: Session takeover with oidc offline refreshtokens
description: A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
problem types: Session Fixation
affected:
{
product: keycloak
vendor: n/a
versions:
version: 20.0.2, status: unaffected
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
defaultStatus: unaffected
packageName: keycloak
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7
collectionURL: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
defaultStatus: unaffected
packageName: keycloak
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6.1
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.3-1.redhat_00002.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.6-1.redhat_00001.1.el7sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el7
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.3-1.redhat_00002.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.6-1.redhat_00001.1.el8sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el8
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.3-1.redhat_00002.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: Red Hat Single Sign-On 7.6 for RHEL 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: rh-sso7-keycloak
defaultStatus: affected
versions:
version: 0:18.0.6-1.redhat_00001.1.el9sso, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:red_hat_single_sign_on:7.6::el9
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-15, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
{
vendor: Red Hat
product: RHEL-8 based Middleware Containers
collectionURL: https://catalog.redhat.com/software/containers/
packageName: rh-sso-7/sso76-openshift-rhel8
defaultStatus: affected
versions:
version: 7.6-20, lessThan: *, versionType: rpm, status: unaffected
cpe: cpe:/a:redhat:rhosemc:1.0::el8
}
metrics:
other: [
content: {'value': 'Moderate', 'namespace': 'https://access.redhat.com/security/updates/classification/'}
type: Red Hat severity rating
]