{"action":"Upgrade org.keycloak:keycloak-parent to 20.0.2 or later.","affected":[{"fixed":"20.0.2","introduced":"0"}],"component":"org.keycloak:keycloak-parent","cve_ids":["CVE-2022-3916"],"ecosystem":"Maven","epss":0.00952,"exploited":false,"fixed_versions":["20.0.2"],"ghsa_id":"GHSA-97g8-xfvw-q4hg","id":"tcs_01M5N8PECSHPV7S4V9QP1TWQK6","modified_at":"2024-02-16T08:22:58.053267Z","published_at":"2022-12-13T19:44:33Z","references":["https://osv.dev/vulnerability/GHSA-97g8-xfvw-q4hg","https://github.com/keycloak/keycloak/security/advisories/GHSA-97g8-xfvw-q4hg","https://nvd.nist.gov/vuln/detail/CVE-2022-3916","https://access.redhat.com/errata/RHSA-2022:8961","https://access.redhat.com/errata/RHSA-2022:8962","https://access.redhat.com/errata/RHSA-2022:8963","https://access.redhat.com/errata/RHSA-2022:8964","https://access.redhat.com/errata/RHSA-2022:8965","https://access.redhat.com/errata/RHSA-2023:1043","https://access.redhat.com/errata/RHSA-2023:1044","https://access.redhat.com/errata/RHSA-2023:1045","https://access.redhat.com/errata/RHSA-2023:1047","https://access.redhat.com/errata/RHSA-2023:1049","https://access.redhat.com/security/cve/CVE-2022-3916","https://bugzilla.redhat.com/show_bug.cgi?id=2141404","https://github.com/keycloak/keycloak"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-97g8-xfvw-q4hg","url":"https://osv.dev/vulnerability/GHSA-97g8-xfvw-q4hg"}],"summary":"Keycloak vulnerable to session takeover with OIDC offline refreshtokens"}