CVE-2019-3868CWE-200

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC

Low · published April 24, 2019

CVSS v3.0
3.8
EPSS
1%
Percentile
62.6
In the wild
Unconfirmed
What it is

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

The record
Technical detail
CVSS v3.0
3.8 · LOW
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01005 · 62.6th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2019-04-24T15:21Z
EPSS history
Timeline
  • 24 APR 15:21Z
    Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC
    cvelistv5