CVE-2024-12369: OIDC-Client Auth Bypass Vulnerability

CVE-2024-12369 Overview

CVE-2024-12369 affects the OpenID Connect (OIDC) client implementations shipped with Red Hat JBoss Enterprise Application Platform (EAP). The flaw impacts the RH SSO OIDC adapter used with EAP 7.x and the elytron-oidc-client subsystem used with EAP 8.x. Both components fail to adequately verify the binding between an authorization code and the client session that initiated the flow. An attacker who can intercept a victim's authorization code through a Man-in-the-Middle (MitM) position or phishing can inject that code into their own session, authenticating as the victim at the client application. The vulnerability is tracked under [CWE-345: Insufficient Verification of Data Authenticity].

Critical Impact
Successful exploitation allows an attacker to assume a victim's identity at the OIDC-protected application, bypassing user authentication through authorization code injection.

Affected Products

Red Hat JBoss EAP 7.x with the RH SSO OIDC adapter
Red Hat JBoss EAP 8.x with the elytron-oidc-client subsystem
WildFly Elytron OIDC HTTP mechanism (upstream)

Discovery Timeline

2024-12-09 - CVE-2024-12369 published to the National Vulnerability Database
2025 - Red Hat releases fixes via advisories RHSA-2025:3989, RHSA-2025:3990, and RHSA-2025:3992
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-12369

Vulnerability Analysis

The OIDC authorization code flow issues a short-lived code parameter to the user agent after successful authentication at the identity provider. The relying party then exchanges that code for ID and access tokens. If the client does not bind the issued code to the specific browser session that started the flow, an attacker who obtains a valid authorization code can submit it from their own session and receive tokens minted for the victim.

The WildFly Elytron OIDC mechanism, which backs both affected EAP paths, did not generate or validate a nonce value for ID tokens. Without a session-bound nonce, the client cannot distinguish a legitimately issued code from one injected by a third party.

Root Cause

The root cause is missing authentication of session binding during the OIDC callback. Per [CWE-345], the client accepted authorization codes and resulting ID tokens without verifying that they originated from an authentication request initiated in the same user session. The upstream fix in WildFly Elytron PR #2253 and PR #2261 introduces nonce generation, a nonce cookie, and validation of the ID token nonce claim.

Attack Vector

Exploitation requires attacker-controlled interception of the victim's authorization code, typically through MitM on a weakly protected channel or a phishing page that proxies the OIDC redirect. The attacker then replays the captured code in their own browser session against the same relying party. User interaction is required and attack complexity is high because the attacker must obtain a live, unused code within its validity window.

java

// Patch excerpt: AuthenticationError.java adds INVALID_NONCE reason
         INVALID_TOKEN,
         STALE_TOKEN,
         NO_AUTHORIZATION_HEADER,
-        NO_QUERY_PARAMETER_ACCESS_TOKEN
+        NO_QUERY_PARAMETER_ACCESS_TOKEN,
+        INVALID_NONCE
     }

     private Reason reason;

// Patch excerpt: ElytronMessages.java adds nonce validation messages
+    @Message(id = 23071, value = "Invalid ID token nonce: %s")
+    String invalidNonceValue(String name);
+
+    @Message(id = 23072, value = "No such algorithm: '%s'")
+    IllegalArgumentException noSuchAlgorithm(String algorithm);
+
+    @Message(id = 23073, value = "Nonce cookie does not exist")
+    String nonceCookieDoesNotExist();

Source: WildFly Elytron commit 5ac5e6b and commit d7754f5. The patches add nonce handling to the OIDC flow so the client rejects ID tokens whose nonce does not match the one stored in the browser session cookie.

Detection Methods for CVE-2024-12369

Indicators of Compromise

OIDC callback requests to EAP applications whose state parameter does not match a prior authorization request issued to the same client session.
Multiple successful authentications for a single user from distinct source IP addresses within a short time window.
Phishing infrastructure or reverse proxies observed intercepting traffic between users and the identity provider's /authorize endpoint.

Detection Strategies

Correlate identity provider authorization logs with EAP access logs to detect codes redeemed from an IP or user agent that did not originate the authorization request.
Alert on EAP sessions where the user identity, source IP, and device fingerprint diverge from the user's historical baseline immediately after an OIDC callback.
Review Elytron logs for the new INVALID_NONCE and Nonce cookie does not exist messages (IDs 23071 and 23073) after patching, which indicate attempted code injection.

Monitoring Recommendations

Forward EAP, RH SSO, and reverse proxy logs to a centralized analytics platform and retain them long enough to reconstruct full OIDC flows.
Monitor for anomalous referer headers on /callback or redirect URIs that do not point back to the identity provider.
Track failed OIDC validation errors over time to surface sustained probing against the authorization code endpoint.

How to Mitigate CVE-2024-12369

Immediate Actions Required

Apply the Red Hat security errata RHSA-2025:3989, RHSA-2025:3990, and RHSA-2025:3992 to all affected EAP 7.x and EAP 8.x deployments.
Inventory applications using the RH SSO OIDC adapter or the elytron-oidc-client subsystem and confirm the patched versions are deployed in production.
Rotate any client secrets associated with OIDC clients that were exposed through unencrypted channels.

Patch Information

Red Hat has published fixes referenced in the Red Hat CVE-2024-12369 advisory. Upstream, the WildFly Elytron project merged nonce support in PR #2253 and PR #2261. After patching, the OIDC flow generates a nonce, stores it in a cookie, and validates the ID token's nonce claim before accepting authentication.

Workarounds

Enforce HTTPS end-to-end between users, the EAP application, and the identity provider to reduce MitM opportunity for intercepting authorization codes.
Require Proof Key for Code Exchange (PKCE) at the identity provider for OIDC clients that support it, which independently binds codes to the initiating session.
Shorten the authorization code validity window at the identity provider to the minimum supported by the OIDC specification.

bash

# Example: verify installed EAP OIDC component versions after patching
rpm -qa | grep -E 'eap7|jboss-eap|elytron'

# Example: enable HSTS at the reverse proxy fronting EAP to harden the OIDC redirect
# Apache httpd
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"