The SAML adapter is expected to change the sesion ID (and the respective JSESSIONID cookie) when the login is performed (except if the option turnOffChangeSessionIdOnLogin is true). This way the session ID is modified in the login to change the previous non-authenticated ID to a new one and avoid using the same valiue (just to protect against a possible cookie hijacking).

Requirements to exploit: You need to hijack the current session before authentication and it will be valid after it. Session fixation issue.

Component affected: org.keycloak.services

Version affected: <= 25.0.2 (also present in RHBK and RHSSO elytron variant).