A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.

Affected: Maven: org.keycloak:keycloak-services

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.

keycloak: impersonation via logout token exchange keycloak: secondary factor bypass in step-up authentication keycloak: Log Injection during WebAuthn authentication or registration keycloak: Authorization Bypass keycloak: XSS via assertion consumer service URL in SAML POST-binding flow keycloak: session hijacking via re-authentication keycloak: path transversal in redirection validation keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkLoginIframe leads to DDoS keycloak: path traversal in the redirect validation

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Benutzerrechte zu erlangen.