CVE-2024-12369

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2024
Source publication: Dec 9, 2024
Source updated: Aug 4, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Elytron-oidc-client: oidc authorization code injection

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

wildfly

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unknown
Package: wildfly
Package collection: https://github.com/wildfly/wildfly

wildfly · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	semver	Unavailable	34.0.1.Final	None listed

Red Hat JBoss Enterprise Application Platform 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8
Platforms: Unknown
Default status: unaffected
Package: org.wildfly/wildfly-elytron-oidc-client-subsystem
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-apache-commons-io
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.16.1-1.redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-bouncycastle
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.80.0-1.redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-eap-product-conf-parent
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:800.7.0-2.GA_redhat_00002.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-hibernate
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:6.2.35-1.Final_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-ironjacamar
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.0.13-1.Final_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-jakarta-enterprise-concurrent
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.0.1-1.redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-jsf-impl
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:4.0.11-1.redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-reactive-streams
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:1.0.4-3.redhat_00004.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-reactivex-rxjava
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:3.1.10-1.redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-weld-core
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:5.1.5-1.Final_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-wildfly
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:8.0.7-3.GA_redhat_00004.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8
Platforms: Unknown
Default status: affected
Package: eap8-wildfly-elytron
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:2.2.9-1.Final_redhat_00001.1.el8eap	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Build of Keycloak

Vendor: Red Hat
Product: Red Hat Build of Keycloak
Platforms: Unknown
Default status: unaffected
Package: wildfly-elytron-oidc-client-subsystem
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat JBoss Enterprise Application Platform 7

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 7
Platforms: Unknown
Default status: affected
Package: org.wildfly/wildfly-elytron-oidc-client-subsystem
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.