{"cve":"CVE-2017-12160","nvd":{"published":"2017-10-26T17:29:00.297","modified":"2026-06-17T01:02:47.873","status":"Modified","description":"It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-287","CWE-285"],"references":["https://access.redhat.com/errata/RHSA-2017:2904","https://access.redhat.com/errata/RHSA-2017:2905","https://access.redhat.com/errata/RHSA-2017:2906","https://bugzilla.redhat.com/show_bug.cgi?id=1484154","https://access.redhat.com/errata/RHSA-2017:2904"],"products":["redhat:keycloak"],"source":"nvd","synced_at":"2026-10-19T20:47:01.408438353+00:00"},"epss":{"cve":"CVE-2017-12160","score":0.01924,"percentile":0.79934,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qc72-gfvw-76h7","url":"https://osv.dev/vulnerability/GHSA-qc72-gfvw-76h7","summary":"Keycloak Oauth Implementation Error","modified":"2024-02-16T08:19:36.439538Z","packages":[{"ecosystem":"Maven","name":"org.keycloak:keycloak-parent","purl":"pkg:maven/org.keycloak/keycloak-parent","ranges":["<3.3.0.Final"],"fixed":["3.3.0.Final"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}