GitHub Advisoryadvisory · Maven

GHSA-c9h6-v78w-52wj Keycloak vulnerable to session hijacking via re-authentication

MEDIUM Published 2024-04-17 Modified 2025-03-14 Official page ↗
Aliases
CVE-2023-6787
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-287, CWE-384, CWE-613
Reviewed
2024-04-17

Affected packages

• Maven org.keycloak:keycloak-services: < 22.0.10 → fixed in 22.0.10 • Maven org.keycloak:keycloak-services: >= 23.0.0, < 24.0.3 → fixed in 24.0.3

Description

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2023-6787 A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. vulnerability

Weakness · CWE (2)

  • CWE-287 Improper Authentication weakness
  • CWE-384 Session Fixation weakness

References