CVE-2024-12369: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2024-12369) was discovered in OIDC-Client affecting RH SSO OIDC adapter with EAP 7.x and elytron-oidc-client subsystem with EAP 8.x. The vulnerability was disclosed on December 9, 2024, and allows authorization code injection attacks that enable attackers to inject stolen authorization codes into their own sessions, potentially impersonating victims (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 4.2 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. It is classified under CWE-345 (Insufficient Verification of Data Authenticity). The vulnerability specifically affects the authentication process where authorization codes can be manipulated during the OpenID provider response phase (Red Hat CVE).

The vulnerability allows attackers to associate their session with a victim's identity by injecting stolen authorization codes. This can lead to unauthorized access and potential impersonation of legitimate users in the affected systems (Red Hat Bugzilla).

Exploitation requires the attacker to first obtain an authorization code from an authorization response sent to the client. The attacker must then initiate their own login process and replace the legitimate authorization code with the stolen one during the OpenID provider's response. The attack typically involves Man-in-the-Middle (MitM) or phishing techniques (NVD).