CVE-2024-7341: redhat build_of_keycloak Session Fixation
Vulnerability summary
CVE-2024-7341 is a high (CVSS 7.1) Session Fixation vulnerability in redhat build_of_keycloak. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 3 · Related 2Timeline
- 09-09-2024PublishedVulnerability first disclosed.
- 27-08-2026Last modifiedVulnerability information updated.
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · MavenEcosystem advisory · calculated7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- NVDNIST7.1HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.85%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
0.00 pp
From 0.85% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat3 products
- build_of_keycloak≥ 22.0, < 22.0.12 | ≥ 24.0, < 24.0.7
- keycloak≤ 25.0.2
- single_sign-on≥ 7.6, < 7.6.10 | na
Org.keycloak1 product
- keycloak-services≥ 25.0.0, < 25.0.5 | < 22.0.12 | ≥ 23.0.0, < 24.0.7
2 vendors · 4 products
References
18 linksShow all 18 references
- github.com/keycloak/keycloakPACKAGE