GitHub Advisoryadvisory · Maven

GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters

HIGH Published 2024-10-14 Modified 2024-12-20 Official page ↗
Aliases
CVE-2024-7341
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-384
Reviewed
2024-10-14

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.12 → fixed in 22.0.12 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.7 → fixed in 24.0.7 • Maven org.keycloak:keycloak-services: >= 25.0.0, < 25.0.5 → fixed in 25.0.5

Description

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

Related

Alias · CVE (1)

  • CVE-2024-7341 A session fixation issue was discovered in the SAML adapters provided by Keycloak. vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References