Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-5rxp-2rhr-qwqv: Session fixation in Elytron SAML adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

ghsa
#js#git#java#auth#maven
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. GHSA-5rxp-2rhr-qwqv

Session fixation in Elytron SAML adapters

High severity GitHub Reviewed Published Oct 14, 2024 in keycloak/keycloak

Package

maven org.keycloak:keycloak-services (Maven)

Affected versions

<= 22.0.11

>= 23.0.0, <= 24.0.6

>= 25.0.0, < 25.0.5

Patched versions

22.0.12

24.0.7

25.0.5

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

References

  • GHSA-5rxp-2rhr-qwqv

Published to the GitHub Advisory Database

Oct 14, 2024

ghsa: Latest News

GHSA-g5vw-3h65-2q3v: Access control vulnerable to user data deletion by anonynmous users