CVE-2017-12160
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
- Record
CVE-2017-12160- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-285, CWE-287
- Updated
- 2026-11-02
CVE List No score
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
- Record
CVE-2017-12160- Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2022-4944 No score
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
- Record
EUVD-2022-4944- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qc72-gfvw-76h7
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
- Record
GHSA-qc72-gfvw-76h7- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-qc72-gfvw-76h7
Keycloak Oauth Implementation Error
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
- Record
GHSA-qc72-gfvw-76h7- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVRHSA-2017:2904
Red Hat Security Advisory: rh-sso7-keycloak security update
- Record
RHSA-2017:2904- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2017:2905
Red Hat Security Advisory: rh-sso7-keycloak security update
- Record
RHSA-2017:2905- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-parentMaven |
before 3.3.0.Final | 3.3.0.Final |
org.keycloak:keycloak-parentMaven |
before 3.3.0.Final, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
3.3.0.Final |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs |
before 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-12160 is a high vulnerability (CVSS 7.2) in Keycloak, published October 26, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.92%, the 80th percentile. Fixed in org.keycloak:keycloak-parent 3.3.0.Final.
References
access.redhat.com/errata/RHSA-2017:2904
bugzilla.redhat.com/show_bug.cgi?id=1484154
nvd.nist.gov/vuln/detail/CVE-2017-12160
github.com/advisories/GHSA-qc72-gfvw-76h7
Show 25 moreShow less
issues.redhat.com/browse/RHSSO-1121
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2904.json
cve.org/CVERecord?id=CVE-2014-9970
Left out here: 26 versions. The JSON record has them.