Vulnerabilities CVE-2024-7341

CVE-2024-7341

High

Open

TLP:CLEAR

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

Details

CVSS Score: 7.1
EPSS Score ⓘ: 0.80%

53.3th percentile
CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Confidence: 90%
Published: Sep 9, 2024
Last Modified: Aug 4, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.