CVE-2023-1584 Quarkus-oidc: id and access tokens leak via the authorization code flow

What is CVE-2023-1584?

CVE-2023-1584 is a high-severity vulnerability in Red Hat RHINT Service Registry 2.5.4 GA, published on 4 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

Weakness: CWE-200

Which versions are affected by CVE-2023-1584?

4 open source packages ship an affected version, including io.quarkus:quarkus-oidc. It affects 1 product.

Products include Quarkus Quarkus.

How do I fix CVE-2023-1584?

Upgrade io.quarkus:quarkus-oidc to a fixed version for your release line: 2.13.0.Final or 3.1.0.Final.

Is CVE-2023-1584 being exploited?

There is no known exploitation of CVE-2023-1584 in the wild and no public exploit code.

Other vulnerabilities in Red Hat RHINT Service Registry 2.5.4 GA

• CVE-2022-4116 Code injection in quarkus dev ui config editor Critical 9.8
• CVE-2022-2466 Quarkus does not terminate HTTP requests header context Critical 9.8
• CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass Critical 9.1
• CVE-2026-39852 Quarkus authorization bypass via semicolon path normalization inconsistency High 8.8
• CVE-2022-0981 Privilege escalation in quarkus High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6hc9-cf8x-hf83.