{"id":"CVE-2024-0560","aliases":["EUVD-2024-16353","GHSA-qc2p-p8wc-jp2h"],"status":"published","title":"Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions","description":"A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00486,"percentile":0.42157,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-280"],"published":"2024-02-28T16:37:01Z","modified":"2026-11-05T11:39:03Z","products":[{"vendor":"red hat","product":"red hat 3scale api management platform 2"},{"vendor":"redhat","product":"3scale"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2024-0560","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258456","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Mitigation","Vendor Advisory"]},{"url":"https://github.com/3scale/APIcast/pull/1438","tags":["x_transferred","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0560"},{"url":"https://github.com/advisories/GHSA-qc2p-p8wc-jp2h"}],"sources":{"cve":[{"id":"CVE-2024-0560","title":"Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions","description":"A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.","status":"published","published":"2024-02-28T16:37:01.247Z","modified":"2026-11-05T11:39:03.159Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-280"],"updated_at":"2026-11-05T13:18:22.408512Z"}],"euvd":[{"id":"EUVD-2024-16353","description":"A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.","status":"published","published":"2024-02-28T16:37:01Z","modified":"2026-11-05T11:39:03Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T13:14:14.11293Z"}],"ghsa":[{"id":"GHSA-qc2p-p8wc-jp2h","title":"A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors....","description":"A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.","status":"published","published":"2024-02-28T18:30:32Z","modified":"2026-03-24T05:07:58Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-280"],"updated_at":"2026-11-02T15:06:48.910736Z"}],"nvd":[{"id":"CVE-2024-0560","description":"A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.","status":"published","published":"2024-02-28T17:15:08.34Z","modified":"2026-11-05T12:17:41.153Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-280"],"updated_at":"2026-11-05T16:36:40.983114Z"}]}}