Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2023-6787Keycloak session hijack via prompt=login re-authentication

high
Product: KeycloakVendor: Red HatDisclosed: 2024-04-17Status: PatchedProtocol deep diveNVD ↗

What broke

Keycloak's re-authentication path (prompt=login) could attach a new login to someone else's active session. A session that looked like step-up was a session hijack. Assigned CVE-2023-6787, public with the April 2024 Keycloak/RHSA train (alongside CVE-2023-6544 and CVE-2023-6717).

Why it matters

prompt=login is how apps force a fresh password or MFA. If that flow can steal a session, step-up is an attack. Same class as Citrix Bleed: the session is the credential.

What to do

  • Upgrade Keycloak to the April 2024 patched line or later.
  • After upgrade, invalidate sessions if the realm was public while vulnerable.
  • Confirm step-up still binds to the existing sub and does not mint a new session for a different user.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.