CVE-2019-3868
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
- Record
CVE-2019-3868- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
EUVDEUVD-2019-0420
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
- Record
EUVD-2019-0420- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gc52-xj6p-9pxp
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
- Record
GHSA-gc52-xj6p-9pxp- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
NVD
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
- Record
CVE-2019-3868- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - CVSS 2.0
- 5.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
- Record
CVE-2019-3868- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-gc52-xj6p-9pxp
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
- Record
GHSA-gc52-xj6p-9pxp- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVRHSA-2019:0856
Red Hat Security Advisory: Red Hat Single Sign-On 7.2.7 security update on RHEL 7
- Record
RHSA-2019:0856- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVRHSA-2019:0857
Red Hat Security Advisory: Red Hat Single Sign-On 7.2.7 security update on RHEL 6
- Record
RHSA-2019:0857- CVSS 3.0
- 3.8 Low
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-coreMaven |
before 6.0.0 | 6.0.0 |
org.keycloak:keycloak-coreMaven |
before 6.0.0, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final |
6.0.0 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 |
before 0:3.4.17-1.Final_redhat_00001.1.jbcs.el7 | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 |
before 0:3.4.17-1.Final_redhat_00001.1.jbcs.el7 | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el7 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 |
before 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6 | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 |
before 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6 | 0:3.4.17-1.Final_redhat_00001.1.jbcs.el6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-3868 is a low vulnerability (CVSS 3.8) in Keycloak, published April 24, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.00%, the 63rd percentile. Fixed in org.keycloak:keycloak-core 6.0.0.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868
securityfocus.com/bid/108061
access.redhat.com/errata/RHSA-2019:1140
nvd.nist.gov/vuln/detail/CVE-2019-3868
github.com/advisories/GHSA-gc52-xj6p-9pxp
Show 10 moreShow less
issues.redhat.com/browse/JBEAP-16660
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0856.json
cve.org/CVERecord?id=CVE-2019-3868
Left out here: 50 versions. The JSON record has them.