CVE-2024-7341
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
CVE-2024-7341- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
EUVDEUVD-2024-2954
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
EUVD-2024-2954- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5rxp-2rhr-qwqv
Keycloak has session fixation in Elytron SAML adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
GHSA-5rxp-2rhr-qwqv- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j76j-rqwj-jmvv
Duplicate Advisory: Keycloak Session Fixation vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5rxp-2rhr-qwqv. This link is maintained to preserve external references.
Original Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
GHSA-j76j-rqwj-jmvv- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
NVD
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
CVE-2024-7341- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSV
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
CVE-2024-7341- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-5rxp-2rhr-qwqv
Keycloak has session fixation in Elytron SAML adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
GHSA-5rxp-2rhr-qwqv- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVGHSA-j76j-rqwj-jmvv
Duplicate Advisory: Keycloak Session Fixation vulnerability
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5rxp-2rhr-qwqv. This link is maintained to preserve external references.
Original Description
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
GHSA-j76j-rqwj-jmvv- CVSS 4.0
- 7.5 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-384
- Updated
- 2026-11-02
OSVRHSA-2024:6493
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 7
- Record
RHSA-2024:6493- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:6494
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 8
- Record
RHSA-2024:6494- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2024:6495
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.10 security update on RHEL 9
- Record
RHSA-2024:6495- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVBIT-keycloak-2024-7341No score
Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
- Record
BIT-keycloak-2024-7341- Updated
- 2026-11-02
Affected products
- redhat keycloak
- redhat build of keycloak
- redhat single sign-on
- red hat build of keycloak
- red hat build of keycloak 22
- red hat build of keycloak 24
- red hat jboss enterprise application platform 8
- red hat single sign-on 7
- red hat single sign-on 7.6 for rhel 7
- red hat single sign-on 7.6 for rhel 8
- red hat single sign-on 7.6 for rhel 9
- red hat rhel-8 based middleware containers
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-servicesMaven | through 22.0.11 | 22.0.12 |
org.keycloak:keycloak-servicesMaven | 23.0.0 to 24.0.6 | 24.0.7 |
org.keycloak:keycloak-servicesMaven | 25.0.0 up to 25.0.5 | 25.0.5 |
keycloakBitnami | 22.0.0 up to 22.0.12, 24.0.0 up to 24.0.7 | 22.0.1224.0.7 |
org.keycloak:keycloak-servicesMaven | before 22.0.12, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final | 22.0.12 |
org.keycloak:keycloak-servicesMaven | 23.0.0 up to 24.0.7, plus listed versions 23.0.123.0.223.0.323.0.423.0.5 Show 8 moreShow less23.0.623.0.724.0.024.0.124.0.224.0.324.0.424.0.5 | 24.0.7 |
org.keycloak:keycloak-servicesMaven | 25.0.0 up to 25.0.5, plus listed versions 25.0.125.0.225.0.325.0.4 | 25.0.5 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 3 CVEs | before 0:18.0.16-1.redhat_00001.1.el7sso | 0:18.0.16-1.redhat_00001.1.el7sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el7 From an advisory covering 3 CVEs | before 0:18.0.16-1.redhat_00001.1.el7sso | 0:18.0.16-1.redhat_00001.1.el7sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 3 CVEs | before 0:18.0.16-1.redhat_00001.1.el8sso | 0:18.0.16-1.redhat_00001.1.el8sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el8 From an advisory covering 3 CVEs | before 0:18.0.16-1.redhat_00001.1.el8sso | 0:18.0.16-1.redhat_00001.1.el8sso |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 3 CVEs | before 0:18.0.16-1.redhat_00001.1.el9sso | 0:18.0.16-1.redhat_00001.1.el9sso |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7.6::el9 From an advisory covering 3 CVEs | before 0:18.0.16-1.redhat_00001.1.el9sso | 0:18.0.16-1.redhat_00001.1.el9sso |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-7341 is a high vulnerability (CVSS 7.1) in Redhat Keycloak, published September 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in org.keycloak:keycloak-services 22.0.12.
References
access.redhat.com/errata/RHSA-2024:6493
Show 30 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2302064
github.com/advisories/GHSA-j76j-rqwj-jmvv
nvd.nist.gov/vuln/detail/CVE-2024-7341
catalog.redhat.com/software/containers
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6493.json
cve.org/CVERecord?id=CVE-2024-4629
Left out here: 110 versions. The JSON record has them.