CVE-2024-7341

highpriority · track · 28EPSS 0.008 · 58 %ileDEEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.85% (58th) EPSS

CVSS 7.1 · high

Is it mine?

23 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1

v3.17.1highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.2 · impact 5.9

v3.17.1highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.1highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · secalert@redhat.com USexploitability 1.2 · impact 5.9

v3.17.1highCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:Hsecondary · OSV

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-384USCWE-384US

affected products (23)

Products and version ranges known to be affected.

Hitachi Ops Centerall versionscert_bundDEcpe:/a:hitachi:ops_center:-
Red Hat OpenShift <Keycloak 24.0.7all versionscert_bundDE
Open Source Keycloak< 25.0.5cert_bundDE
Red Hat OpenShift< Keycloak 24.0.7cert_bundDE
Red Hat RHEL-8 based Middleware Containers< 7.6-52enisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 7< 0:18.0.16-1.redhat_00001.1.el7ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 8< 0:18.0.16-1.redhat_00001.1.el8ssoenisa_euvdEU
Red Hat Red Hat Single Sign-On 7.6 for RHEL 9< 0:18.0.16-1.redhat_00001.1.el9ssoenisa_euvdEU
Red Hat Red Hat build of Keycloak 22< 22-17enisa_euvdEU
Red Hat Red Hat build of Keycloak 22< 22-20enisa_euvdEU
Red Hat Red Hat build of Keycloak 22< 22.0.12-1enisa_euvdEU
Red Hat Red Hat build of Keycloak 24< 24-16enisa_euvdEU
Red Hat Red Hat build of Keycloak 24< 24.0.7-4enisa_euvdEU
redhat build of keycloak22.0 → 22.0.12nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat build of keycloak24.0 → 24.0.7nvdUScpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*
redhat keycloak≤ 25.0.2nvdUScpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
redhat single sign-onall versionsnvdUScpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
redhat single sign-on7.6 → 7.6.10nvdUScpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*
Bitnami keycloak22.0.0 → 22.0.12osvUSpkg:bitnami/keycloak
Bitnami keycloak24.0.0 → 24.0.7osvUSpkg:bitnami/keycloak

showing 20 of 23

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-2080Keycloak: Schwachstelle Umgehung von SicherheitsvorkehrungenDeutsch2024-09-09csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen
WID-SEC-W-2024-2083Red Hat OpenShift Keycloak: Mehrere SchwachstellenDeutsch2024-09-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um falsche Informationen darzustellen um die Authentifizierung zu umgehen.
GHSA-5rxp-2rhr-qwqvKeycloak has session fixation in Elytron SAML adapters2024-10-14ghsa · osvUS
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
GHSA-j76j-rqwj-jmvvDuplicate Advisory: Keycloak Session Fixation vulnerability2024-09-09ghsa · osvUS
# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5rxp-2rhr-qwqv. This link is maintained to preserve external references. # Original Description A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when `the turnOffChangeSessionIdOnLogin` option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
BIT-keycloak-2024-7341Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters2026-08-25vendor · osvUS
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

also known as (6)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund nvd NVD CVE.org MITRE

published 2024-09-09modified 2026-08-27

references (39)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan