The vulnerability CVE-2024-12369 affects the OIDC-Client used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x and 8.x. It allows an attacker to perform authorization code injection attacks by injecting a stolen authorization code into their own client session, thereby assuming the victim's identity. This flaw arises from insufficient verification of data authenticity in the RH SSO OIDC adapter and the elytron-oidc-client subsystem. The vulnerability has a CVSS 3.1 base score of 4.2, indicating medium severity. Red Hat has issued security advisories and released version 8.0.7 of JBoss EAP with fixes for this vulnerability.

An attacker who successfully exploits this vulnerability can inject a stolen authorization code into their own session, allowing them to impersonate another user's identity within the affected client application. This could lead to unauthorized access to resources or actions performed with the victim's privileges. The attack requires user interaction (UI:R) and a high attack complexity (AC:H), with no privileges required (PR:N) and network attack vector (AV:N). The confidentiality and integrity impacts are low, and availability is not affected.

Red Hat has released security updates in JBoss Enterprise Application Platform version 8.0.7 that address this vulnerability. Users should apply the 8.0.7 update or later to remediate the issue. Before applying the update, ensure all previously released errata are applied and back up existing installations, including applications, configuration files, and databases. Follow Red Hat's official update instructions at https://access.redhat.com/articles/11258. No other mitigation steps are indicated by the vendor advisory.