CVE-2023-6787: Keycloak vulnerable to session hijacking via re-authentication
(updated )
A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.
References
- access.redhat.com/errata/RHSA-2024:1867
- access.redhat.com/errata/RHSA-2024:1868
- access.redhat.com/security/cve/CVE-2023-6787
- bugzilla.redhat.com/show_bug.cgi?id=2254375
- github.com/advisories/GHSA-c9h6-v78w-52wj
- github.com/keycloak/keycloak
- github.com/keycloak/keycloak/security/advisories/GHSA-c9h6-v78w-52wj
- nvd.nist.gov/vuln/detail/CVE-2023-6787
Code Behaviors & Features
Detect and mitigate CVE-2023-6787 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →