CVE-2024-7341

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

State: Published
Severity: 7.1 High
Published: Sep 9, 2024
Updated: Aug 27, 2026
Reserved: Jul 31, 2024

Description

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H	redhat

Weaknesses

CWE-384 Session Fixation

Affected Products

Product	Versions
org.keycloak:keycloak-services	before 22.0.12Affected 23.0.0 to before 24.0.7Affected 25.0.0 to before 25.0.5Affected
Red Hat Build of KeycloakRed Hat
Red Hat Build of KeycloakRed Hat
Red Hat build of Keycloak 22Red Hat	22.0.12-1 and laterNot affected
Red Hat build of Keycloak 22Red Hat	22-17 and laterNot affected
Red Hat build of Keycloak 22Red Hat	22-20 and laterNot affected
Red Hat build of Keycloak 24Red Hat	24.0.7-4 and laterNot affected
Red Hat build of Keycloak 24Red Hat	24-16 and laterNot affected
Red Hat build of Keycloak 24Red Hat	24-16 and laterNot affected
Red Hat Single Sign-On 7Red Hat
Red Hat Single Sign-On 7.6 for RHEL 7Red Hat	0:18.0.16-1.redhat_00001.1.el7sso and laterNot affected
Red Hat Single Sign-On 7.6 for RHEL 8Red Hat	0:18.0.16-1.redhat_00001.1.el8sso and laterNot affected
Red Hat Single Sign-On 7.6 for RHEL 9Red Hat	0:18.0.16-1.redhat_00001.1.el9sso and laterNot affected
RHEL-8 based Middleware ContainersRed Hat	7.6-52 and laterNot affected
Red Hat JBoss Enterprise Application Platform 8Red Hat

References

RHSA-2024:6493vendor-advisory
RHSA-2024:6494vendor-advisory
RHSA-2024:6495vendor-advisory
RHSA-2024:6497vendor-advisory
RHSA-2024:6499vendor-advisory
RHSA-2024:6500vendor-advisory
RHSA-2024:6501vendor-advisory
RHSA-2024:6502vendor-advisory
RHSA-2024:6503vendor-advisory
https://access.redhat.com/security/cve/CVE-2024-7341vdb-entry
RHBZ#2302064issue-tracking
https://github.com/advisories/GHSA-j76j-rqwj-jmvv

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.