Session Fixation In org.keycloak:keycloak-services
Description
Keycloak vulnerable to session hijacking via re-authentication A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 maven | 22.0.10, 24.0.3 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2.