CVE-2024-7341

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2024
Source publication: Sep 9, 2024
Source updated: Aug 27, 2026
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

org.keycloak:keycloak-services

Vendor: Unknown
Product: Unknown
Platforms: Unknown
Default status: unaffected
Package: org.keycloak:keycloak-services
Package collection: https://github.com/keycloak/keycloak

org.keycloak:keycloak-services · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0	`affected`	semver	22.0.12	Unavailable	None listed
23.0.0	`affected`	semver	24.0.7	Unavailable	None listed
25.0.0	`affected`	semver	25.0.5	Unavailable	None listed

Red Hat Build of Keycloak

Vendor: Red Hat
Product: Red Hat Build of Keycloak
Platforms: Unknown
Default status: unaffected
Package: keycloak-services
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Build of Keycloak

Vendor: Red Hat
Product: Red Hat Build of Keycloak
Platforms: Unknown
Default status: unaffected
Package: keycloak-services
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat build of Keycloak 22

Vendor: Red Hat
Product: Red Hat build of Keycloak 22
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
22.0.12-1	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 22

Vendor: Red Hat
Product: Red Hat build of Keycloak 22
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
22-17	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 22

Vendor: Red Hat
Product: Red Hat build of Keycloak 22
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 22 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
22-20	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 24

Vendor: Red Hat
Product: Red Hat build of Keycloak 24
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-operator-bundle
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 24 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
24.0.7-4	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 24

Vendor: Red Hat
Product: Red Hat build of Keycloak 24
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 24 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
24-16	`unaffected`	rpm	*	Unavailable	None listed

Red Hat build of Keycloak 24

Vendor: Red Hat
Product: Red Hat build of Keycloak 24
Platforms: Unknown
Default status: affected
Package: rhbk/keycloak-rhel9-operator
Package collection: https://catalog.redhat.com/software/containers/

Red Hat build of Keycloak 24 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
24-16	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7
Platforms: Unknown
Default status: unaffected
Package: keycloak-services
Package collection: https://access.redhat.com/downloads/content/package-browser/

No explicit version tuples; consult this entry's default status.

Red Hat Single Sign-On 7.6 for RHEL 7

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 7
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 7 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.16-1.redhat_00001.1.el7sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 8

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 8
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 8 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.16-1.redhat_00001.1.el8sso	`unaffected`	rpm	*	Unavailable	None listed

Red Hat Single Sign-On 7.6 for RHEL 9

Vendor: Red Hat
Product: Red Hat Single Sign-On 7.6 for RHEL 9
Platforms: Unknown
Default status: affected
Package: rh-sso7-keycloak
Package collection: https://access.redhat.com/downloads/content/package-browser/

Red Hat Single Sign-On 7.6 for RHEL 9 · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
0:18.0.16-1.redhat_00001.1.el9sso	`unaffected`	rpm	*	Unavailable	None listed

RHEL-8 based Middleware Containers

Vendor: Red Hat
Product: RHEL-8 based Middleware Containers
Platforms: Unknown
Default status: affected
Package: rh-sso-7/sso76-openshift-rhel8
Package collection: https://catalog.redhat.com/software/containers/

RHEL-8 based Middleware Containers · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
7.6-52	`unaffected`	rpm	*	Unavailable	None listed

Red Hat JBoss Enterprise Application Platform 8

Vendor: Red Hat
Product: Red Hat JBoss Enterprise Application Platform 8
Platforms: Unknown
Default status: unaffected
Package: keycloak-services
Package collection: https://access.redhat.com/jbossnetwork/restricted/listSoftware.html

No explicit version tuples; consult this entry's default status.