1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-C9H6-V78W-52WJ

[MAVEN:GHSA-C9H6-V78W-52WJ] Keycloak vulnerable to session hijacking via re-authentication

Severity Moderate
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.

Package Affected Version
pkg:maven/org.keycloak/keycloak-services >= 23.0.0, < 24.0.3
pkg:maven/org.keycloak/keycloak-services < 22.0.10
Package Fixed Version
pkg:maven/org.keycloak/keycloak-services = 24.0.3
pkg:maven/org.keycloak/keycloak-services = 22.0.10
ID
MAVEN:GHSA-C9H6-V78W-52WJ
Severity
moderate
URL
https://github.com/advisories/GHSA-c9h6-v78w-52wj
Published
2024-04-17T18:25:29
(5 months ago)
Modified
2024-04-17T18:25:30
(5 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services >= 23.0.0 < 24.0.3
Fixed pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services = 24.0.3
Affected pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services < 22.0.10
Fixed pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services = 22.0.10
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date