CVE-2023-1584: 
Java vulnerability analysis and mitigation

A security vulnerability (CVE-2023-1584) was discovered in Quarkus OIDC that could leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used. The vulnerability was disclosed in March 2023 and affects Quarkus applications using OIDC authentication (NVD).

The vulnerability exists in the Quarkus OIDC implementation where both ID and access tokens could be exposed during the authorization code flow when using insecure HTTP protocol. The issue was addressed by implementing encryption of the session cookie value by default, using AES GCM encryption for the token data (GitHub PR).

If exploited, this vulnerability could allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. However, it's important to note that passwords are not stored in access tokens (Red Hat CVE).

The vulnerability is exploitable when the application uses insecure HTTP protocol for OIDC authentication. The risk is particularly relevant in scenarios where the application authenticates to OpenId Connect provider with mTLS or uses JWT tokens signed with private asymmetric keys (GitHub PR).

The vulnerability was patched by implementing encryption of the session cookie value by default. The fix includes using AESGCM Key wrap for key encryption and AES GCM for content encryption. Users should ensure proper configuration of encryption keys, especially when using mTLS or JWT token authentication. The fix was included in Quarkus versions 2.13.8 and 3.0.2 (Red Hat Advisory).