Keycloak vulnerable to session hijacking via re-authentication
Date: 2024-04
Affected: maven/org.keycloak:keycloak-services, maven/org.keycloak:keycloak-services
Attack vector: other
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2023-6717
CVE-2023-6787
CWE: CWE-20
CWE-287
CWE-384
CWE-601
CWE-613
CWE-79
CVSS: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.


Mitigations:

Architectural layers (MAESTRO):