High severityOSV Advisory· Published Sep 9, 2024· Updated Apr 1, 2026
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
CVE-2024-7341
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | < 22.0.12 | 22.0.12 |
org.keycloak:keycloak-servicesMaven | >= 23.0.0, < 24.0.7 | 24.0.7 |
org.keycloak:keycloak-servicesMaven | >= 25.0.0, < 25.0.5 | 25.0.5 |
Affected products
8- Range: 1.0-alpha-1, 1.0-alpha-1-12062013, 1.0-alpha-2, …
- osv-coords7 versionspkg:apk/chainguard/keycloak-bitnami-fipspkg:apk/chainguard/keycloak-fipspkg:apk/chainguard/keycloak-fips-bitnami-compatpkg:apk/chainguard/keycloak-fips-policy-140-2pkg:apk/chainguard/keycloak-fips-policy-140-3pkg:apk/chainguard/keycloak-iamguarded-fipspkg:maven/org.keycloak/keycloak-services
< 25.0.4-r0+ 6 more
- (no CPE)range: < 25.0.4-r0
- (no CPE)range: < 25.0.4-r0
- (no CPE)range: < 25.0.4-r0
- (no CPE)range: < 25.0.4-r0
- (no CPE)range: < 25.0.4-r0
- (no CPE)range: < 25.0.4-r0
- (no CPE)range: < 22.0.12
Patches
Vulnerability mechanics
References
18- access.redhat.com/errata/RHSA-2024:6493ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6494ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6495ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6497ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6499ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6500ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6501ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6502ghsavendor-advisoryx_refsource_REDHATWEB
- access.redhat.com/errata/RHSA-2024:6503ghsavendor-advisoryx_refsource_REDHATWEB
- github.com/advisories/GHSA-5rxp-2rhr-qwqvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-7341ghsaADVISORY
- access.redhat.com/security/cve/CVE-2024-7341ghsavdb-entryx_refsource_REDHATWEB
- bugzilla.redhat.com/show_bug.cgighsaissue-trackingx_refsource_REDHATWEB
- github.com/keycloak/keycloak/commit/2341d6ee7a3567c58fd6a04a419fe4403e13374cghsaWEB
- github.com/keycloak/keycloak/commit/5b3de0c7e7f367103affe2f5167913a2ce021cf1ghsaWEB
- github.com/keycloak/keycloak/commit/5e06da2f6794c695051605e26a01affa3a18f66bghsaWEB
- github.com/keycloak/keycloak/security/advisories/GHSA-5rxp-2rhr-qwqvghsaWEB
- github.com/advisories/GHSA-j76j-rqwj-jmvvmitre
News mentions
0No linked articles in our index yet.