Headline
GHSA-5rxp-2rhr-qwqv: Session fixation in Elytron SAML adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- GitHub Advisory Database
- GitHub Reviewed
- GHSA-5rxp-2rhr-qwqv
Session fixation in Elytron SAML adapters
High severity GitHub Reviewed Published Oct 14, 2024 in keycloak/keycloak
Package
maven org.keycloak:keycloak-services (Maven)
Affected versions
<= 22.0.11
>= 23.0.0, <= 24.0.6
>= 25.0.0, < 25.0.5
Patched versions
22.0.12
24.0.7
25.0.5
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
References
- GHSA-5rxp-2rhr-qwqv
Published to the GitHub Advisory Database
Oct 14, 2024