Search for vulnerabilities
Vulnerability details: VCID-dqcp-m1ty-u7fr
Vulnerability ID VCID-dqcp-m1ty-u7fr
Aliases CVE-2017-12160
GHSA-qc72-gfvw-76h7
Summary Keycloak Oauth Implementation Error It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-287 Improper Authentication
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-285 Improper Authorization
System Score Found at
cvssv3.1 7.2 https://access.redhat.com/errata/RHSA-2017:2904
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:2904
cvssv3.1 7.2 https://access.redhat.com/errata/RHSA-2017:2905
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:2905
cvssv3.1 7.2 https://access.redhat.com/errata/RHSA-2017:2906
generic_textual HIGH https://access.redhat.com/errata/RHSA-2017:2906
cvssv3 3.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12160.json
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
epss 0.0046 https://api.first.org/data/v1/epss?cve=CVE-2017-12160
cvssv3.1 7.2 https://bugzilla.redhat.com/show_bug.cgi?id=1484154
generic_textual HIGH https://bugzilla.redhat.com/show_bug.cgi?id=1484154
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-qc72-gfvw-76h7
cvssv3.1 7.2 https://github.com/keycloak/keycloak
generic_textual HIGH https://github.com/keycloak/keycloak
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2017-12160
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2017-12160
Reference id Reference type URL
https://access.redhat.com/errata/RHSA-2017:2904
https://access.redhat.com/errata/RHSA-2017:2905
https://access.redhat.com/errata/RHSA-2017:2906
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12160.json
https://api.first.org/data/v1/epss?cve=CVE-2017-12160
https://bugzilla.redhat.com/show_bug.cgi?id=1484154
https://github.com/keycloak/keycloak
https://nvd.nist.gov/vuln/detail/CVE-2017-12160
GHSA-qc72-gfvw-76h7 https://github.com/advisories/GHSA-qc72-gfvw-76h7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:2904
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:2905
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/errata/RHSA-2017:2906
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-12160.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1484154
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/keycloak/keycloak
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-12160
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.63137
EPSS Score 0.0046
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:11:22.193049+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-qc72-gfvw-76h7/GHSA-qc72-gfvw-76h7.json 37.0.0