CVE-2023-1584

A flaw was found in Quarkus. Quarkus OIDC can leak both ID and access tokens in the authorization code flow when an insecure HTTP protocol is used, which can allow attackers to access sensitive user data directly from the ID token or by using the access token to access user data from OIDC provider services. Please note that passwords are not stored in access tokens.

• CWE-200

• https://access.redhat.com/errata/RHSA-2023:3809Third Party Advisory
• https://access.redhat.com/errata/RHSA-2023:7653
• https://access.redhat.com/security/cve/CVE-2023-1584Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2180886Issue Tracking, Third Party Advisory
• https://github.com/quarkusio/quarkus/pull/32192Vendor Advisory
• https://github.com/quarkusio/quarkus/pull/33414Vendor Advisory
• https://access.redhat.com/errata/RHSA-2023:3809Third Party Advisory
• https://access.redhat.com/errata/RHSA-2023:7653
• https://access.redhat.com/security/cve/CVE-2023-1584Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2180886Issue Tracking, Third Party Advisory
• https://github.com/quarkusio/quarkus/pull/32192Vendor Advisory
• https://github.com/quarkusio/quarkus/pull/33414Vendor Advisory

Published

Oct 4, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-1577A path hijacking vulnerability was reported in Lenovo Driver…7.8
• CVE-2023-1578SQL Injection in GitHub repository pimcore/pimcore prior to …8.8
• CVE-2023-1579Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in b…7.8
• CVE-2023-1580Uncontrolled resource consumption in the logging feature in …7.5
• CVE-2023-1582A race problem was found in fs/proc/task_mmu.c in the memory…4.7
• CVE-2023-1583A NULL pointer dereference was found in io_file_bitmap_get i…5.5
• CVE-2023-1585Avast and AVG Antivirus for Windows were susceptible to a Ti…6.3
• CVE-2023-1586Avast and AVG Antivirus for Windows were susceptible to a Ti…4.7
• CVE-2023-1587Avast and AVG Antivirus for Windows were susceptible to a NU…5.5
• CVE-2023-1588Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-1589A vulnerability has been found in SourceCodester Online Tour…9.8
• CVE-2023-1590A vulnerability was found in SourceCodester Online Tours & T…9.8