CVE-2016-8609: red hat keycloak Session Fixation
CVSS: 8.1v3.0HighModified
AliasesGHSA-95m6-mjh3-58gm
Published 01-08-2018Last modified 06-08-2024
Vulnerability summary
CVE-2016-8609 is a high (CVSS 8.1) Session Fixation vulnerability in red hat keycloak. EPSS estimates a 1.68% chance of exploitation in the next 30 days, higher than 76.5% of scored vulnerabilities.
CVSS score
8.1/10
010
High · v3.0 (NVD)EPSS score
1.68%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 01-08-2018PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.1Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSources3 sources · 3.7–8.1
- CVE.orgCNA3.7LowCVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NDiffers
- OSV · MavenEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Medium 5.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:NSourcesSingle source
EPSS trend
Probability
1.68%
Chance of exploitation in the next 30 days
Percentile
77%
Versus all other CVEs
30-day change
0.00 pp
From 1.68% on 18-09-2026
18-09-202618-10-2026
EPSS score1.68%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Org.keycloak1 product
- keycloak-core< 2.3.0
Red hat1 product
- keycloak2.3.0
Redhat1 product
- keycloak< 2.3.0
3 vendors · 3 products
