CVE-2024-7341
This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.85%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- CVSS 3.1
- 7.1 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.85% probability · 58th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-384
- Affected
- redhat/keycloak · redhat/single sign-on · redhat/build of keycloak
- Source
- secalert@redhat.com
EPSS 0.8% since 26 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://access.redhat.com/errata/RHSA-2024:6493Mailing List
- https://access.redhat.com/errata/RHSA-2024:6494Mailing List
- https://access.redhat.com/errata/RHSA-2024:6495Mailing List
- https://access.redhat.com/errata/RHSA-2024:6497Mailing List
- https://access.redhat.com/errata/RHSA-2024:6499Mailing List
- https://access.redhat.com/errata/RHSA-2024:6500Mailing List
- https://access.redhat.com/errata/RHSA-2024:6501Mailing List
- https://access.redhat.com/errata/RHSA-2024:6502Mailing List
- https://access.redhat.com/errata/RHSA-2024:6503Mailing List
- https://access.redhat.com/security/cve/CVE-2024-7341Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2302064Issue Tracking, Vendor Advisory
- https://github.com/advisories/GHSA-j76j-rqwj-jmvv
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.