{"id":"GHSA-4v5x-9m47-cqr2","summary":"Duplicate Advisory: WildFly Elytron OpenID Connect Client Extension authorization code injection attack","details":"# Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of [GHSA-5565-3c98-g6jc](https://advisory-inbox.githubapp.com/advisory_reviews/GHSA-5565-3c98-g6jc). This link is maintained to preserve external references.\n\n# Original Description\nA vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.","modified":"2026-02-03T03:05:16.013164Z","published":"2024-12-09T21:31:02Z","withdrawn":"2025-03-25T21:48:41Z","database_specific":{"cwe_ids":["CWE-345"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-12-10T19:06:02Z","nvd_published_at":"2024-12-09T21:15:08Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-12369"},{"type":"WEB","url":"https://github.com/wildfly-security/wildfly-elytron/pull/2253"},{"type":"WEB","url":"https://github.com/wildfly-security/wildfly-elytron/pull/2261"},{"type":"WEB","url":"https://github.com/wildfly-security/wildfly-elytron/commit/5ac5e6bbcba58883b3cebb2ddbcec4de140c5ceb"},{"type":"WEB","url":"https://github.com/wildfly-security/wildfly-elytron/commit/d7754f5a6a91ceb0f4dbbbfe301991f6a55404cb"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2025:3989"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2025:3990"},{"type":"WEB","url":"https://access.redhat.com/errata/RHSA-2025:3992"},{"type":"WEB","url":"https://access.redhat.com/security/cve/CVE-2024-12369"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2331178"},{"type":"PACKAGE","url":"https://github.com/wildfly/wildfly"}],"affected":[{"package":{"name":"org.wildfly:wildfly-elytron-oidc-client-subsystem","ecosystem":"Maven","purl":"pkg:maven/org.wildfly/wildfly-elytron-oidc-client-subsystem"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"34.0.1.Final"}]}],"versions":["25.0.0.Beta1","25.0.0.Final","25.0.1.Final","26.0.0.Beta1","26.0.0.Final","26.0.1.Final","26.1.0.Beta1","26.1.0.Final","26.1.1.Final","26.1.2.Final","26.1.3.Final","27.0.0.Alpha1","27.0.0.Alpha2","27.0.0.Alpha3","27.0.0.Alpha4","27.0.0.Alpha5","27.0.0.Beta1","27.0.0.Final","27.0.1.Final","28.0.0.Beta1","28.0.0.Final","28.0.1.Final","29.0.0.Alpha1","29.0.0.Beta1","29.0.0.Final","29.0.1.Final","30.0.0.Beta1","30.0.0.Final","30.0.1.Final","31.0.0.Beta1","31.0.0.Final","31.0.1.Final","32.0.0.Beta1","32.0.0.Final","32.0.1.Final","33.0.0.Beta1","33.0.0.Final","33.0.1.Final","33.0.2.Final","34.0.0.Beta1","34.0.0.Final","34.0.1.Final"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/12/GHSA-4v5x-9m47-cqr2/GHSA-4v5x-9m47-cqr2.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}