CVE-2023-22492 (zitadel)

ZITADEL is a combination of Auth0 and Keycloak. RefreshTokens is an OAuth 2.0 feature that allows applications to retrieve new access tokens and refresh the user's session without the need for interacting with a UI. RefreshTokens were not invalidated when a user was locked or deactivated. The deactivated or locked user was able to obtain a valid access token only through a refresh token grant. When the locked or deactivated user’s session was already terminated (“logged outâ€�) then it was …

access access token access tokens applications auth0 cve grant keycloak locked oauth oauth 2.0 refresh token session token tokens valid zitadel