CVE-2023-6236: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2023-6236) was discovered in Red Hat Enterprise Application Platform 8 affecting its OIDC (OpenID Connect) implementation. The vulnerability was disclosed on April 9, 2024, and affects multi-tenant OIDC applications. The issue lies in the OidcSessionTokenStore component when determining if a cached token should be used, specifically not properly handling the 'provider-url' option alongside the 'realm' option (Red Hat CVE).

The vulnerability stems from insufficient verification of data authenticity (CWE-345) in the OidcSessionTokenStore component. When an OIDC application serving multiple tenants attempts to access a second tenant, it fails to properly validate the authentication requirements, allowing potential reuse of cached tokens. The vulnerability has received a CVSS v3.1 base score of 7.3 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (Red Hat CVE).

The vulnerability could allow unauthorized access to different tenants within a multi-tenant OIDC application. When an application attempts to access a second tenant that is secured with a different OIDC configuration, the system fails to enforce proper authentication, potentially leading to security bypass (NVD).

The vulnerability can be exploited remotely without requiring special privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit in affected systems (Red Hat CVE).

Red Hat has released security updates to address this vulnerability in Red Hat JBoss Enterprise Application Platform 8.0.2. The fix is available through multiple security advisories including RHSA-2024:3580, RHSA-2024:3581, and RHSA-2024:3583. It's worth noting that EAP-7 is not affected by this vulnerability as it does not provide the vulnerable provider-url configuration option in its OIDC implementation (Red Hat Advisory).