Description
A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
keycloak
0 to < 22.0.10affected0 to < 24.0.3affected
Red Hat Red Hat build of Keycloak 22
Default version status: affected
22.0.10-1 to < *unaffected
Red Hat Red Hat build of Keycloak 22
Default version status: affected
22-13 to < *unaffected
Red Hat Red Hat build of Keycloak 22
Default version status: affected
22-16 to < *unaffected
Red Hat Red Hat build of Keycloak 22.0.10
Default version status: unaffected
Red Hat Red Hat Single Sign-On 7
Default version status: affected