BIT-KEYCLOAK-2024-7341 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

org.keycloak:keycloak-saml-undertow-adapter (25.0.6), org.keycloak:keycloak-saml-wildfly-adapter-dist (25.0.6) +3 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-adapter-core (25.0.6)

org.keycloak:keycloak-saml-adapter-core MAVEN version 25.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-adapter-core and may be impacted: - org.keycloak:keycloak-saml-undertow-adapter 25.0.6 -...

org.keycloak:keycloak-saml-jetty-adapter-core (3.3.0.cr1), org.keycloak:keycloak-saml-jetty81-adapter (3.3.0.cr1) +22 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-adapter-core (3.3.0.cr1)

org.keycloak:keycloak-saml-adapter-core MAVEN version 3.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-adapter-core and may be impacted: - org.keycloak:keycloak-saml-jetty-adapter-core 3.3.0.cr1 -...

org.keycloak:keycloak-saml-jetty-adapter-core (23.0.6), org.keycloak:keycloak-saml-jetty94-adapter (23.0.6) +10 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-adapter-core (23.0.6)

org.keycloak:keycloak-saml-adapter-core MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-adapter-core and may be impacted: - org.keycloak:keycloak-saml-jetty-adapter-core 23.0.6 -...

org.keycloak:keycloak-saml-adapter-api-public (4.0.0.final), org.keycloak:keycloak-saml-adapter-core (4.0.0.final) +25 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-core (4.0.0.final)

org.keycloak:keycloak-saml-core MAVEN version 4.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-saml-adapter-api-public 4.0.0.final -...

EUVD-2024-2954

Malicious code in bioql PyPI...

GHSA-5RXP-2RHR-QWQV Keycloak has session fixation in Elytron SAML adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

org.keycloak:keycloak-dependencies-server-all (9.0.0), org.keycloak:keycloak-saml-adapter-api-public (9.0.0) +23 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (9.0.0)

org.keycloak:keycloak-saml-core MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 9.0.0 - org.keycloak:keycloak-saml-adapter-api-publ...

org.keycloak:keycloak-dependencies-server-all (3.3.0.cr2), org.keycloak:keycloak-saml-adapter-api-public (3.3.0.cr2) +26 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (3.3.0.cr2)

org.keycloak:keycloak-saml-core MAVEN version 3.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.3.0.cr2 -...

CVE-2024-7341 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

CVE-2024-7341 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

CVE-2024-7341

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 22.0.12 Update

New Red Hat build of Keycloak 22.0.12 packages are available from the Customer Portal. This is a security update with Moderate impact rating. Red Hat build of Keycloak 22.0.12 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on...

wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update

A security update is now available for Red Hat Single Sign-On 7.6 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...