NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
MEDIUM severity

CVE-2022-3916 — keycloak-parent

MEDIUM

CVE-2022-3916 is a medium-severity (CVSS 6.8) CWE-384 vulnerability in org.keycloak:keycloak-parent. A fix is available for org.keycloak:keycloak-parent — see the affected versions and patch details below.

Keycloak: session takeover with oidc offline refreshtokens

Also known asGHSA-97g8-xfvw-q4hg
Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Nov 1, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-3916.

EPSS Exploitation Probability

via FIRST.org ↗
1.0%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs61th percentile — riskier than 61% of all scored CVEsHighest risk
0.00%0.48%0.97%1.45%0.2%1.0%May 26Aug 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
☕org.keycloak:keycloak-parent

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

An issue was discovered in Keycloak when using a client with the offline_access scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.

This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offline_access scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.keycloak:keycloak-parentall versions20.0.2org.keycloak:keycloak-parent:20.0.2

Affected Products

6 products · 11 configurations
Application
keycloakredhat
< 20.0.2
range
Application
openshift container platformredhat
2 versions
4.94.10
Application
openshift container platform for linuxoneredhat
2 versions
4.94.10
Application
openshift container platform for powerredhat
2 versions
4.94.10
Application
openshift container platform ibm z systemsredhat
2 versions
4.94.10
Application
single sign-onredhat
1 version
7.6

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.keycloak:keycloak-parent, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.keycloak:keycloak-parent to 20.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2022-3916 is resolved across your whole dependency graph.

  3. Workarounds

    Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatModerate
ProductFixed inAdvisory
Red Hat Single Sign-On 7rh-sso7-keycloakRHSA-2023:1049
Red Hat Single Sign-On 7.6.1rh-sso7-keycloakRHSA-2022:8965
Red Hat Single Sign-On 7.6 for RHEL 7rh-sso7-keycloak-0:18.0.3-1.redhat_00002.1.el7ssoRHSA-2022:8961
Red Hat Single Sign-On 7.6 for RHEL 7rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7ssoRHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8rh-sso7-keycloak-0:18.0.3-1.redhat_00002.1.el8ssoRHSA-2022:8962
Red Hat Single Sign-On 7.6 for RHEL 8rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el8ssoRHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9rh-sso7-keycloak-0:18.0.3-1.redhat_00002.1.el9ssoRHSA-2022:8963
Red Hat Single Sign-On 7.6 for RHEL 9rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9ssoRHSA-2023:1045

Frequently Asked Questions

An issue was discovered in Keycloak when using a client with the `offline_access` scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user. This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the `offline_access` scope, and another user authenticates to the application. In that case, it will share the same root session id, a
O3 Security · Impact-Aware SCA

Is CVE-2022-3916 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2022-3916: keycloak-parent — Fixed in 20.0.2