7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
30.6%
quarkus-oidc is vulnerable to Insecure OIDC Session Cookie Handling. The vulnerability exists because the library does not properly encrypt the OIDC session cookie value by default which leads to the leakage of both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, allowing an attacker to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services.
access.redhat.com/errata/RHSA-2023:3809
access.redhat.com/errata/RHSA-2023:7653
access.redhat.com/security/cve/CVE-2023-1584
bugzilla.redhat.com/show_bug.cgi?id=2180886
github.com/advisories/GHSA-6hc9-cf8x-hf83
github.com/quarkusio/quarkus/commit/5369d7ff233d3afe84ecd9160c541fba52b38e69
github.com/quarkusio/quarkus/commit/df305ff12386cf28b33567b8d9a18db164f019dd
github.com/quarkusio/quarkus/pull/32192
github.com/quarkusio/quarkus/pull/33414