Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Moderate severity
GitHub Reviewed
Published
Apr 30, 2019
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Apr 24, 2019
Reviewed
Apr 30, 2019
Published to the GitHub Advisory Database
Apr 30, 2019
Last updated
Feb 1, 2023
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
References