CVE-2024-0560

A vulnerability was found in 3Scale, when used with Keycloak 15 (or RHSSO 7.5.0) and superiors. When the auth_type is use_3scale_oidc_issuer_endpoint, the Token Introspection policy discovers the Token Introspection endpoint from the token_introspection_endpoint field, but the field was removed on RH-SSO 7.5. As a result, the policy doesn't inspect tokens, it determines that all tokens are valid.

• CWE-280

• https://access.redhat.com/security/cve/CVE-2024-0560Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2258456Mitigation, Vendor Advisory
• https://github.com/3scale/APIcast/pull/1438Patch
• https://access.redhat.com/security/cve/CVE-2024-0560Mitigation, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2258456Mitigation, Vendor Advisory
• https://github.com/3scale/APIcast/pull/1438Patch

Published

Feb 28, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0554A Cross-site scripting (XSS) vulnerability has been found on…5.4
• CVE-2024-0555A Cross-Site Request Forgery (CSRF) vulnerability has been f…8
• CVE-2024-0556A Weak Cryptography for Passwords vulnerability has been det…6.5
• CVE-2024-0557A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2024-0558A vulnerability has been found in DedeBIZ 6.3.0 and classifi…7.2
• CVE-2024-0559The Enhanced Text Widget WordPress plugin before 1.6.6 does …6.5
• CVE-2024-0561The Ultimate Posts Widget WordPress plugin before 2.3.1 does…5.4
• CVE-2024-0562A use-after-free flaw was found in the Linux Kernel. When a …7.8
• CVE-2024-0563Denial of service condition in M-Files Server in versions be…6.5
• CVE-2024-0564A flaw was found in the Linux kernel's memory deduplication …6.5
• CVE-2024-0565An out-of-bounds memory read flaw was found in receive_encry…7.4
• CVE-2024-0566The Smart Manager WordPress plugin before 8.28.0 does not pr…7.2