CVE-2024-12369

Summary

CVE-2024-12369 is a newly discovered vulnerability affecting the OpenID Connect (OIDC) client. This issue arises when using the Red Hat Single Sign-On (RH SSO) OIDC adapter with EAP 7.x or the elytron-oidc-client subsystem with EAP 8.x. An attacker can successfully conduct authorization code injection attacks, allowing them to insert a stolen authorization code into their own session with the client, assuming the victim's identity. Such attacks usually occur through Man-in-the-Middle (MitM) or phishing methods.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.