Quarkus-oidc: id and access tokens leak via the authorization code flow
Priority LOW 35CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.
Why it matters now
EPSS 0.00963 61st percentileScored 2026-11-07
Fix Fixed quarkus-oidc: 3.1.0.CR1io.quarkus:quarkus-oidc (Maven): 2.13.0.Final, 3.1.0.FinalRed Hat: 2 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | quarkus-oidc | — | 3.1.0.CR1 | Patch available | CNA |
| Red Hat | Red Hat build of Quarkus 2.13.8.Final | — | 2.13.8.Final-redhat-00004 | Patch available | CNA |
| Red Hat | RHINT Service Registry 2.5.4 GA | — | — | Not affected | CNA |
| — | io.quarkus:quarkus-oidc (Maven) | before 2.13.0.Final | 2.13.0.Final | Patch available | GHSA-6hc9-cf8x-hf83 |
| — | io.quarkus:quarkus-oidc (Maven) | 3.0.0 to before 3.1.0.Final | 3.1.0.Final | Patch available | GHSA-6hc9-cf8x-hf83 |
- quarkus-oidc Vendor— Affected — Fixed in 3.1.0.CR1 Patch available CNA
- Red Hat build of Quarkus 2.13.8.Final VendorRed Hat Affected — Fixed in 2.13.8.Final-redhat-00004 Patch available CNA
- RHINT Service Registry 2.5.4 GA VendorRed Hat Affected — Fixed in — Not affected CNA
- io.quarkus:quarkus-oidc (Maven) Vendor— Affected before 2.13.0.Final Fixed in 2.13.0.Final Patch available GHSA-6hc9-cf8x-hf83
- io.quarkus:quarkus-oidc (Maven) Vendor— Affected 3.0.0 to before 3.1.0.Final Fixed in 3.1.0.Final Patch available GHSA-6hc9-cf8x-hf83
Remediation
- Fix · CNA quarkus-oidc Fixed in 3.1.0.CR1
- Fix · GHSA-6hc9-cf8x-hf83 io.quarkus:quarkus-oidc (Maven) Fixed in 2.13.0.Final Advisory →
- Fix · GHSA-6hc9-cf8x-hf83 io.quarkus:quarkus-oidc (Maven) Fixed in 3.1.0.Final Advisory →
Red Hat 2 advisories
- RHSA-2023:7653 Released 2023-12-05 · Red Hat rating ImportantService Registry (container images) release and security update [2.5.4 GA]
- RHINT Service Registry 2.5.4 GA
- RHSA-2023:3809 Released 2023-06-29 · Red Hat rating ModerateRed Hat build of Quarkus 2.13.8 release and security update
- Red Hat build of Quarkus 2.13.8.Final com.graphql-java.graphql-java-19.4.0.redhat-00001.jar, io.quarkus.quarkus-grpc-2.13.8.Final-redhat-00004.jar, io.quarkus.quarkus-oidc-2.13.8.Final-redhat-00004.jar +3
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| RHINT Service Registry 2.5.4 GA | Fixed | RHSA-2023:7653 |
| Red Hat build of Quarkus 2.13.8.Final | Fixed | RHSA-2023:3809 |
Not affected: 1 product
- Red Hat build of Quarkus 2.13.8.Final
Timeline
- 2026-10-02 Threatist record created from CVE-2023-1584
- 2026-10-03 Alias added: GHSA-6hc9-cf8x-hf83
References
Advisory 7
Other 5
- https://github.com/quarkusio/quarkus/pull/32192/commits/5369d7ff233d3afe84ecd9160c541fba52b38e69
- https://github.com/quarkusio/quarkus/pull/33414/commits/df305ff12386cf28b33567b8d9a18db164f019dd
- https://github.com/quarkusio/quarkus/commit/5369d7ff233d3afe84ecd9160c541fba52b38e69
- https://github.com/quarkusio/quarkus/commit/df305ff12386cf28b33567b8d9a18db164f019dd
- https://github.com/quarkusio/quarkus
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-1584 · CVE Program
- CVE-2023-1584 · NVD
- FIRST EPSS
- GHSA-6hc9-cf8x-hf83 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-1584 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences