CVE-2024-7341: Red Hat Build Of Keycloak

High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days.

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

Affected products

• Red Hat Build Of Keycloak: from 22.0, before 22.0.12 (fixed in 22.0.12); from 24.0, before 24.0.7 (fixed in 24.0.7)
• Red Hat Keycloak: up to and including 25.0.2
• Red Hat Single Sign-On: from 7.6, before 7.6.10 (fixed in 7.6.10); affected versions not specified

Published 2024-09-09. Last modified 2026-08-27.