Threats Tagged 'cve-2023-6236'
View all threats tagged with 'cve-2023-6236'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'cve-2023-6236'
Click on any threat for detailed analysis and mitigation recommendations
0 CVE-2023-6236 is a high-severity vulnerability in Red Hat JBoss Enterprise Application Platform 8 related to insufficient verification of data authenticity in its OpenID Connect (OIDC) implementation. The flaw arises when a multi-tenant OIDC application accesses a second tenant secured by a different OIDC configuration but fails to prompt for re-authentication due to improper token validation logic. Specifically, the OidcSessionTokenStore component does not consider the new 'provider-url' parameter alongside the 'realm' parameter when deciding to reuse cached tokens, potentially allowing unauthorized access across tenants. This vulnerability does not affect EAP-7, which lacks the vulnerable 'provider-url' option. The CVSS 3.1 score is 7.3 (high), reflecting network exploitability without authentication or user interaction, and impacts confidentiality, integrity, and availability. No known exploits are reported in the wild yet. European organizations using Red Hat JBoss EAP 8 for multi-tenant OIDC applications should prioritize patching and reviewing their authentication flows to prevent cross-tenant token misuse. Join the discussion | CVE Database V5 | 04/10/2024, 01:04:53 UTC Added: 11/20/2025, 18:22:04 UTC |
Showing 1 to 1 of 1 result