Id and access tokens leak via the authorization code flow

CVE-2023-1584

Summary

A security flaw in Quarkus OIDC has been identified, allowing the potential leakage of ID and access tokens when utilizing an insecure HTTP protocol during the authorization code flow. This vulnerability creates avenues for attackers to gain access to sensitive user data either directly from the ID token or by exploiting the access token to interact with OIDC provider services. It is important to note that the access tokens do not store passwords, yet their exposure could still result in significant privacy and security issues.

References