CVE-2023-6787: Keycloak: session hijacking via re-authentication
A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.
Other sources
A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.
— Red Hat
A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 24.0.3 - Upgrade
Upgrade
maven/org.keycloak:keycloak-servicesto a version that resolves this vulnerability.Fixed in 22.0.10
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6787?
CVE-2023-6787 has a high severity rating due to its potential to allow session hijacking in Keycloak.
What software versions are affected by CVE-2023-6787?
CVE-2023-6787 affects Keycloak versions between 23.0.0 and 24.0.3, as well as versions up to 22.0.10.
How do I fix CVE-2023-6787?
To fix CVE-2023-6787, upgrade Keycloak to version 24.0.3 or 22.0.10 or later.
What type of vulnerability is CVE-2023-6787?
CVE-2023-6787 is a vulnerability related to the re-authentication mechanism in Keycloak.
How does CVE-2023-6787 affect user sessions?
CVE-2023-6787 allows unauthorized users to hijack active Keycloak sessions by triggering a new authentication process.