{"id":"INC-redhat-zxx6ktwrcjnq","kind":"incident","aliases":[],"related":[],"title":"Red Hat: sso.redhat.com Offline Token Issue","description":"The incident has been mitigated . Our the team will continue working on the root cause analysis (RCA).","summary":"Red Hat reported an incident affecting offline tokens on sso.redhat.com and says it has been mitigated while root cause analysis continues. The sources do not state what an attacker could gain or which accounts or sessions were involved.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Red Hat","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","red-hat","red-hat-sso","redhat","security","sso","vendor"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-08-12T13:12:54+00:00","first_seen_at":"2026-11-14T01:28:04+00:00","triaged_at":"2026-11-14T01:29:39+00:00","updated_at":"2026-11-14T01:29:39+00:00","category":"vendor","confidence":0.4,"triage":{"at":"2026-11-14T01:29:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Red Hat SSO: offline token issue at sso.redhat.com, mitigated, root cause pending","impact":"medium","summary":"Red Hat reported an incident affecting offline tokens on sso.redhat.com and says it has been mitigated while root cause analysis continues. The sources do not state what an attacker could gain or which accounts or sessions were involved.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["red-hat","sso","red-hat-sso"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown","analyst_note":"Find the Red Hat statuspage post (https://stspg.io/zf6rk0mc5r6w) and any RCA for the offline token behaviour and whether tokens were exposed or revoked.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00065,"input_tokens":4481,"output_tokens":403,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'account':58B 'affect':30B 'analysi':44B,78C 'attack':53B 'caus':43B,77C 'continu':45B,72C 'could':54B 'gain':55B 'hat':2A,12A,16B,19B,26B 'inc':8A 'inc-redhat-zxx6ktwrcjnq':7A 'incid':13B,29B,64C 'involv':62B 'issu':6A 'mitig':40B,67C 'offlin':4A,31B 'rca':79C 'red':1A,11A,15B,18B,25B 'red-hat':14B 'red-hat-sso':17B 'redhat':9A,21B 'report':27B 'root':42B,76C 'say':36B 'secur':22B 'session':60B 'sourc':47B 'sso':20B,23B 'sso.redhat.com':3A,34B 'state':50B 'team':70C 'token':5A,32B 'vendor':24B 'work':73C 'zxx6ktwrcjnq':10A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hat","redhat"],"ptokens":["hat","red"],"labels":["high","incident","redhat","redhatsso","security","sso","vendor"],"campaign_type":null,"search_a":"'hat':2A,12A 'inc':8A 'inc-redhat-zxx6ktwrcjnq':7A 'issu':6A 'offlin':4A 'red':1A,11A 'redhat':9A 'sso.redhat.com':3A 'token':5A 'zxx6ktwrcjnq':10A","search_b":"'account':58B 'affect':30B 'analysi':44B 'attack':53B 'caus':43B 'continu':45B 'could':54B 'gain':55B 'hat':16B,19B,26B 'incid':13B,29B 'involv':62B 'mitig':40B 'offlin':31B 'red':15B,18B,25B 'red-hat':14B 'red-hat-sso':17B 'redhat':21B 'report':27B 'root':42B 'say':36B 'secur':22B 'session':60B 'sourc':47B 'sso':20B,23B 'sso.redhat.com':34B 'state':50B 'token':32B 'vendor':24B","search_c":"'analysi':78C 'caus':77C 'continu':72C 'incid':64C 'mitig':67C 'rca':79C 'root':76C 'team':70C 'work':73C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-08-12T13:12:54+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"redhat:zxx6ktwrcjnq","url":"https://stspg.io/zf6rk0mc5r6w","severity":"high","published_at":"2026-08-12T13:12:54+00:00","modified_at":"2026-08-12T16:11:23+00:00","first_seen_at":"2026-11-14T01:28:04+00:00","fetched_at":"2026-11-14T02:04:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}