VULNERABILITY INTELLIGENCE

CVE-2017-12160

CVSS score7.2 HIGH
EPSS probability1.92%
CISA KEVNot currently listed
Published2017-10-26
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.

Weakness classification

  • CWE-285: Improper Authorization
  • CWE-287: Improper Authentication

Primary references