Record status Published
Identifier year (not publication year) 2022
Source publication Sep 20, 2023
Source updated Aug 3, 2024
Imported by cveboard Oct 24, 2026
CNA source text (English) Keycloak: session takeover with oidc offline refreshtokens
A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat Single Sign-On 7
Vendor Red Hat
Product Red Hat Single Sign-On 7
Platforms Unknown
Default status unaffected
Package keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Single Sign-On 7.6.1
Vendor Red Hat
Product Red Hat Single Sign-On 7.6.1
Platforms Unknown
Default status unaffected
Package keycloak
Package collection https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.
Red Hat Single Sign-On 7.6 for RHEL 7
Vendor Red Hat
Product Red Hat Single Sign-On 7.6 for RHEL 7
Platforms Unknown
Default status affected
Package rh-sso7-keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Single Sign-On 7.6 for RHEL 7 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0:18.0.3-1.redhat_00002.1.el7sso unaffectedrpm * Unavailable None listed
Red Hat Single Sign-On 7.6 for RHEL 7
Vendor Red Hat
Product Red Hat Single Sign-On 7.6 for RHEL 7
Platforms Unknown
Default status affected
Package rh-sso7-keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Single Sign-On 7.6 for RHEL 7 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0:18.0.6-1.redhat_00001.1.el7sso unaffectedrpm * Unavailable None listed
Red Hat Single Sign-On 7.6 for RHEL 8
Vendor Red Hat
Product Red Hat Single Sign-On 7.6 for RHEL 8
Platforms Unknown
Default status affected
Package rh-sso7-keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Single Sign-On 7.6 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0:18.0.3-1.redhat_00002.1.el8sso unaffectedrpm * Unavailable None listed
Red Hat Single Sign-On 7.6 for RHEL 8
Vendor Red Hat
Product Red Hat Single Sign-On 7.6 for RHEL 8
Platforms Unknown
Default status affected
Package rh-sso7-keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Single Sign-On 7.6 for RHEL 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0:18.0.6-1.redhat_00001.1.el8sso unaffectedrpm * Unavailable None listed
Red Hat Single Sign-On 7.6 for RHEL 9
Vendor Red Hat
Product Red Hat Single Sign-On 7.6 for RHEL 9
Platforms Unknown
Default status affected
Package rh-sso7-keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Single Sign-On 7.6 for RHEL 9 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0:18.0.3-1.redhat_00002.1.el9sso unaffectedrpm * Unavailable None listed
Red Hat Single Sign-On 7.6 for RHEL 9
Vendor Red Hat
Product Red Hat Single Sign-On 7.6 for RHEL 9
Platforms Unknown
Default status affected
Package rh-sso7-keycloak
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Single Sign-On 7.6 for RHEL 9 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0:18.0.6-1.redhat_00001.1.el9sso unaffectedrpm * Unavailable None listed
RHEL-8 based Middleware Containers
Vendor Red Hat
Product RHEL-8 based Middleware Containers
Platforms Unknown
Default status affected
Package rh-sso-7/sso76-openshift-rhel8
Package collection https://catalog.redhat.com/software/containers/
RHEL-8 based Middleware Containers · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 7.6-15 unaffectedrpm * Unavailable None listed
RHEL-8 based Middleware Containers
Vendor Red Hat
Product RHEL-8 based Middleware Containers
Platforms Unknown
Default status affected
Package rh-sso-7/sso76-openshift-rhel8
Package collection https://catalog.redhat.com/software/containers/
RHEL-8 based Middleware Containers · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 7.6-20 unaffectedrpm * Unavailable None listed