Most recent entries from all

bdu:2024-02081

EUVD-2026-260512

fkie_cve-2023-6787

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.

GHSA-c9h6-v78w-52wj — Keycloak vulnerable to session hijacking via re-authentication

Affected: Maven: org.keycloak:keycloak-services

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.

gsd-2023-6787

RHSA-2024:1867 — Red Hat Security Advisory: Red Hat build of Keycloak 22.0.10 enhancement and security update

keycloak: impersonation via logout token exchange keycloak: secondary factor bypass in step-up authentication keycloak: Log Injection during WebAuthn authentication or registration keycloak: Authorization Bypass keycloak: XSS via assertion consumer service URL in SAML POST-binding flow keycloak: session hijacking via re-authentication keycloak: path transversal in redirection validation keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkLoginIframe leads to DDoS keycloak: path traversal in the redirect validation

WID-SEC-W-2024-0466 — Keycloak: Schwachstelle ermöglicht Erlangen von Benutzerrechten

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Benutzerrechte zu erlangen.