Bruno Oliveira da Silva ae423840d8 Validate tx_code before consuming pre-authorized code in OID4VCI ...

Move tx_code and originating session validation before the
singleUseStore.putIfAbsent() call in PreAuthorizedCodeGrantType.
Previously, a wrong or missing tx_code would permanently burn the
pre-authorized code with no rollback, allowing an attacker who only
has the QR code to invalidate the credential offer without knowing
the PIN. Now the code is consumed only after all validations pass.

Also hardens the MessageDigest.isEqual comparison to use explicit
UTF-8 encoding instead of the platform-dependent default charset.

Closes #49787

AI Disclosure: This commit was authored with the assistance of
an AI coding tool. All changes were reviewed and
approved by the committer.

Signed-off-by: Bruno Oliveira da Silva <bruno@abstractj.com>

2026-10-07 10:26:30 +02:00

..

src/main/java/org/keycloak/testsuite/util

Validate tx_code before consuming pre-authorized code in OID4VCI

2026-10-07 10:26:30 +02:00

pom.xml

fix: renaming the admin client tests module for use by the operator (#51675)

2026-08-24 15:14:32 -04:00