Id and access tokens leak via the authorization code flow

CVE-2023-1584

What is CVE-2023-1584?

A security flaw in Quarkus OIDC has been identified, allowing the potential leakage of ID and access tokens when utilizing an insecure HTTP protocol during the authorization code flow. This vulnerability creates avenues for attackers to gain access to sensitive user data either directly from the ID token or by exploiting the access token to interact with OIDC provider services. It is important to note that the access tokens do not store passwords, yet their exposure could still result in significant privacy and security issues.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References