Description

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

Remediation

References

http://www.securityfocus.com/bid/108061

https://access.redhat.com/errata/RHSA-2019:1140

https://access.redhat.com/errata/RHSA-2019:2998

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868

Related Vulnerabilities

CVE-2018-3818 Vulnerability in npm package kibana

CVE-2021-23448 Vulnerability in npm package config-handler

CVE-2020-36377 Vulnerability in npm package aaptjs

CVE-2018-9207 Vulnerability in npm package jquery-file-upload

CVE-2021-23421 Vulnerability in npm package merge-change

Severity

Low

Classification

CWE-200 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Tags

Third Party Advisory Issue Tracking Vendor Advisory