GHSA-gc52-xj6p-9pxpMediumCVSS 3.8

Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

Published
April 30, 2019
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2019-3868 →

📋 Description

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.

🎯 Affected products1

  • maven/org.keycloak:keycloak-core:< 6.0.0

🔗 References (6)