CVE-2017-12159
Keycloak CSRF Vulnerability
CVE-2017-12159 is a high vulnerability (CVSS 7.5) in Keycloak, published October 26, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.71%, the 86th percentile. Fixed in org.keycloak:keycloak-parent 3.4.0.
- Severity
- 7.5 HighCVSS 3.0, NVD
- Exploit chance
- 2.71%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.4.0org.keycloak:keycloak-parent +5 more
Description
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.keycloak:keycloak-parentMaven | before 3.4.0 | 3.4.0 |
org.keycloak:keycloak-parentMaven | before 3.4.0, plus listed versions 1.0-alpha-11.0-alpha-1-120620131.0-alpha-21.0-alpha-31.0-alpha-4 Show 45 moreShow less1.0-beta-11.0-beta-1-201505211.0-beta-1-201505231.0-beta-21.0-beta-31.0-beta-41.0-final1.0-rc-11.0-rc-21.0.1.Final1.0.2.Final1.0.3.Final1.0.4.Final1.0.5.Final1.1.0.Beta11.1.0.Beta21.1.0.Final1.1.1.Final1.2.0.Beta11.2.0.CR11.2.0.Final1.3.0.Final1.3.1.Final1.4.0.Final1.5.0-Final1.5.0.Final1.5.1.Final1.6.0.Final1.6.1.Final1.7.0.CR11.7.0.Final1.8.0.Alpha11.8.0.CR11.8.0.CR21.8.0.CR31.8.0.Final1.8.1.Final1.9.0.CR11.9.0.Final1.9.1.Final1.9.2.Final1.9.3.Final1.9.4.Final1.9.5.Final1.9.7.Final | 3.4.0 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs | before 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el6 From an advisory covering 5 CVEs | before 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el6 |
rh-sso7-keycloakRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs | before 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 |
rh-sso7-keycloak-serverRed Hat:red_hat_single_sign_on:7::el7 From an advisory covering 5 CVEs | before 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 | 0:2.5.14-1.Final_redhat_1.1.jbcs.el7 |
What each source reports
NVD Score used
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
- Record
CVE-2017-12159- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
CVE ListNo score
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
- Record
CVE-2017-12159- Weakness
- CWE-613
- Updated
- 2026-11-02
EUVDEUVD-2022-2987No score
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
- Record
EUVD-2022-2987- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7fmw-85qm-h22p
Keycloak CSRF Vulnerability
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
- Record
GHSA-7fmw-85qm-h22p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVGHSA-7fmw-85qm-h22p
Keycloak CSRF Vulnerability
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
- Record
GHSA-7fmw-85qm-h22p- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-613
- Updated
- 2026-11-02
OSVRHSA-2017:2904
Red Hat Security Advisory: rh-sso7-keycloak security update
- Record
RHSA-2017:2904- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-13
OSVRHSA-2017:2905
Red Hat Security Advisory: rh-sso7-keycloak security update
- Record
RHSA-2017:2905- CVSS 3.0
- 5.4 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
bugzilla.redhat.com/show_bug.cgi?id=1484111
access.redhat.com/errata/RHSA-2017:2904
securityfocus.com/bid/101601
nvd.nist.gov/vuln/detail/CVE-2017-12159
Show 26 moreShow less
web.archive.org/web/20210124113906/http://www.securityfocus.com/bid/101601
github.com/advisories/GHSA-7fmw-85qm-h22p
issues.redhat.com/browse/RHSSO-1121
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2904.json
cve.org/CVERecord?id=CVE-2014-9970
Left out here: 28 versions. The JSON record has them.