Patch Ticker

Red Hat build of Keycloak authentication race allows account takeover

Attackers with a login here can take over other people's accounts.

Summary

A flaw in how the Keycloak login server handles authentication sessions lets an attacker who can already log in attach their login state to another user's session, take over the victim's account, and change its password. Red Hat build of Keycloak 26.4, 26.6 and Red Hat Single Sign-On 7 are affected.

Affected when

  • Attacker holds a login account on the server

What to do

Update the 26.4 line to 26.4.17 and the 26.6 line to 26.6.8. Red Hat Single Sign-On 7 names no fixed version, so check the Red Hat advisory.

Update to at least the version for your product:

  • Red Hat build of Keycloak 26.4 26.4.17 or later
  • Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

  • Red Hat build of Keycloak 26.4
  • Red Hat build of Keycloak 26.4.17
  • Red Hat build of Keycloak 26.6
  • Red Hat build of Keycloak 26.6.8
  • Red Hat Single Sign-On 7

CVE IDs

Sources

Times

First published

First seen