| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-parent | < 20.0.2 | 20.0.2 |
| keycloak | < 20.0.2 | 20.0.2 |
| openshift container platform | = 4.10= 4.9 | |
| openshift container platform for linuxone | = 4.10= 4.9 | |
| openshift container platform for power | = 4.10= 4.9 | |
| openshift container platform ibm z systems | = 4.10= 4.9 | |
| single sign-on | = 7.6 |
An issue was discovered in Keycloak when using a client with the offline_access scope. Reuse of session ids across root and user authentication sessions and a lack of root session validation enabled attackers to resolve a user session attached to a different previously authenticated user.
This issue most affects users of shared computers. Suppose a user logs out of their account (without clearing their cookies) in a mobile app or similar client that includes the offline_access scope, and another user authenticates to the application. In that case, it will share the same root session id, and when utilizing the refresh token, they will be issued a token for the original user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free