CVE-2023-6787
Severity:
MEDIUM
Type:
CWE-287
Authentication Issues
Publication date:
25/04/2024
Last modified:
25/04/2024
Description
A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter "prompt=login," prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting "Restart login," an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session.
Impact
Base Score 3.x
6.50
Severity 3.x
MEDIUM