CVE-2022-3916: redhat keycloak Session Fixation

Vulnerability summary

CVE-2022-3916 is a medium (CVSS 6.8) Session Fixation vulnerability in redhat keycloak. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.6% of scored vulnerabilities.

Timeline

1. 20-09-2023
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.

• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."