A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin opti…
High CVSS 7.1
Summary
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- https://access.redhat.com/errata/RHSA-2024:6493 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6494 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6495 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6497 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6499 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6500 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6501 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6502 Mailing List
- https://access.redhat.com/errata/RHSA-2024:6503 Mailing List
- https://access.redhat.com/security/cve/CVE-2024-7341 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2302064 Issue Tracking
- https://github.com/advisories/GHSA-j76j-rqwj-jmvv
Timeline
- nvd_ingest NVD