Eap: oidc app attempting to access the second tenant, the user should be prompted to log
Priority LOW 38CWE-345Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-345.
Summary
A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00328 26th percentileScored 2026-11-07
Fix Partial org.wildfly.security:wildfly-elytron-http-oidc (Maven): 2.2.5.FinalRed Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 4.0.1-1.Final_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 | — | 2.2.4-2.SP01_redhat_00001.1.el8eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 4.0.1-1.Final_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 | — | 2.2.4-2.SP01_redhat_00001.1.el9eap | Patch available | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack | — | — | No fix listed | CNA |
| — | org.wildfly.security:wildfly-elytron-http-oidc (Maven) | before 2.2.5.Final | 2.2.5.Final | Patch available | GHSA-jpmx-996v-48fm |
- Red Hat JBoss Enterprise Application Platform 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 4.0.1-1.Final_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 VendorRed Hat Affected — Fixed in 2.2.4-2.SP01_redhat_00001.1.el8eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 4.0.1-1.Final_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9 VendorRed Hat Affected — Fixed in 2.2.4-2.SP01_redhat_00001.1.el9eap Patch available CNA
- Red Hat JBoss Enterprise Application Platform 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat JBoss Enterprise Application Platform Expansion Pack VendorRed Hat Affected — Fixed in — No fix listed CNA
- org.wildfly.security:wildfly-elytron-http-oidc (Maven) Vendor— Affected before 2.2.5.Final Fixed in 2.2.5.Final Patch available GHSA-jpmx-996v-48fm
CPE names CNA · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 | 8.0 | — | Red Hat |
| cpe:/a:redhat:jboss_enterprise_application_platform:7 | 7 | — | Red Hat |
| cpe:/a:redhat:jbosseapxp | — | — | Red Hat |
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el8 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:8.0::el9 Versions 8.0 — ·Red Hat
- cpe:/a:redhat:jboss_enterprise_application_platform:7 Versions 7 — ·Red Hat
- cpe:/a:redhat:jbosseapxp Versions — — ·Red Hat
Remediation
- Fix · GHSA-jpmx-996v-48fm org.wildfly.security:wildfly-elytron-http-oidc (Maven) Fixed in 2.2.5.Final Advisory →
Red Hat 3 advisories
- RHSA-2024:3580 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss EAP 8.0 for RHEL 8 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el8eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el8eap +47
- RHSA-2024:3581 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss EAP 8.0 for RHEL 9 eap8-activemq-artemis-2.21.0-4.redhat_00048.1.el9eap, eap8-activemq-artemis-cli-2.21.0-4.redhat_00048.1.el9eap, eap8-activemq-artemis-commons-2.21.0-4.redhat_00048.1.el9eap +47
- RHSA-2024:3583 Released 2024-06-04 · Red Hat rating ModerateRed Hat JBoss Enterprise Application Platform 8.0.2 Security update
- Red Hat JBoss Enterprise Application Platform 8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | — |
| Red Hat JBoss EAP 8.0 for RHEL 8 | Fixed | RHSA-2024:3580 |
| Red Hat JBoss EAP 8.0 for RHEL 9 | Fixed | RHSA-2024:3581 |
| Red Hat JBoss Enterprise Application Platform 8 | Fixed | RHSA-2024:3583 |
Not affected: 3 products
- Red Hat JBoss EAP 8.0 for RHEL 8
- Red Hat JBoss EAP 8.0 for RHEL 9
- Red Hat JBoss Enterprise Application Platform 7
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6236
- 2026-10-03 Alias added: GHSA-jpmx-996v-48fm
References
More Red Hat vulnerabilities
- TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
- TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
- TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-6236 · CVE Program
- CVE-2023-6236 · NVD
- FIRST EPSS
- GHSA-jpmx-996v-48fm · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6236 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences