org.wildfly.security:wildfly-elytron-http-oidc@2.6.1.Final vulnerabilities

Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the OIDC-Client subsystem. An attacker can impersonate a victim by injecting a stolen authorization code into their own session.

Note: This is only exploitable if the following happens-

1. The attacker obtains an authorization code from an authorization response sent to the client, accesses the application and starts the login process with the legitimate client.

2. The attacker replaces the newly sent authorization code with the previously stolen authorization code in the response of the OpenID provider to the legitimate client.

3. The legitimate client sends that stolen authorization code along with its credentials to the OpenID provider to exchange the code for a token.

4. The OpenID provider's checks will succeed, and a token will be issued to the client.

5. The attacker has now associated their session with the legitimate client with the victim's identity.

Upgrade org.wildfly.security:wildfly-elytron-http-oidc to version 2.2.9.Final, 2.6.2.Final or higher.