Description
A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | wildfly | ≤ 34.0.1.Final | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | — |
| Red Hat | Red Hat Build of Keycloak | — | — |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-apache-commons-io | 2.16.1-1.redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-bouncycastle +5 | 1.80.0-1.redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 800.7.0-2.GA_redhat_00002.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-hibernate +2 | 6.2.35-1.Final_redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-ironjacamar +8 | 3.0.13-1.Final_redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-jakarta-enterprise-concurrent | 3.0.1-1.redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-jsf-impl | 4.0.11-1.redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-reactive-streams | 1.0.4-3.redhat_00004.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-reactivex-rxjava | 3.1.10-1.redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-weld-ejb +6 | 5.1.5-1.Final_redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-wildfly +4 | 8.0.7-3.GA_redhat_00004.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
| Red Hat JBoss EAP 8 | eap8-wildfly-elytron +1 | 2.2.9-1.Final_redhat_00001.1.el8eap | RHSA-2025:3990, RHSA-2025:3989 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | wildfly +4 | 35.0.1-r16 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.wildfly.security:wildfly-elytron | >= 1.17.0.Final, < 2.2.9.Final | 2.2.9.Final | GHSA-5565-3c98-g6jc |
| Maven | org.wildfly.security:wildfly-elytron | >= 2.3.0.Final, < 2.6.2.Final | 2.6.2.Final | GHSA-5565-3c98-g6jc |
| Maven | org.wildfly.security:wildfly-elytron-http-oidc | >= 1.17.0.Final, < 2.2.9.Final | 2.2.9.Final | GHSA-5565-3c98-g6jc |
| Maven | org.wildfly.security:wildfly-elytron-http-oidc | >= 2.3.0.Final, < 2.6.2.Final | 2.6.2.Final | GHSA-5565-3c98-g6jc |
Advisories 2
- RHSA-2025:3989 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.7 security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
- RHSA-2025:3990 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0.7 security update Red Hat Security Advisories (RHSA) · Sep 18, 2026
References
- RHSA-2025:3989 vendor-advisory
- RHSA-2025:3990 vendor-advisory
- RHSA-2025:3992 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-12369 vdb-entry
- RHBZ#2331178 issue-tracking
- https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb
- https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb
- https://github.com/wildfly-security/wildfly-elytron/pull/2253
- https://github.com/wildfly-security/wildfly-elytron/pull/2261