TI-2019-02878 CVE-2019-3868 · GHSA-gc52-xj6p-9pxp
Information disclosure in Red Hat keycloak
Priority LOW 20
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC.