Insufficient session expiration in Red Hat keycloak
Priority LOW 38CWE-613Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
Why it matters now
EPSS 0.02711 86th percentileScored 2026-11-07
Fix Fixed org.keycloak:keycloak-parent (Maven): 3.4.0Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | keycloak | 3.4.0 | — | No fix listed | CNA |
| — | org.keycloak:keycloak-parent (Maven) | before 3.4.0 | 3.4.0 | Patch available | GHSA-7fmw-85qm-h22p |
- keycloak VendorRed Hat Affected 3.4.0 Fixed in — No fix listed CNA
- org.keycloak:keycloak-parent (Maven) Vendor— Affected before 3.4.0 Fixed in 3.4.0 Patch available GHSA-7fmw-85qm-h22p
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:single_sign_on:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:single_sign_on:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:a:keycloak:keycloak:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Keycloak |
- cpe:2.3:a:redhat:single_sign_on:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:single_sign_on:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:a:keycloak:keycloak:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Keycloak
Remediation
- Fix · GHSA-7fmw-85qm-h22p org.keycloak:keycloak-parent (Maven) Fixed in 3.4.0 Advisory →
Red Hat 3 advisories
- RHSA-2017:2905 Released 2017-10-17 · Red Hat rating Moderaterh-sso7-keycloak security update
- Red Hat Single Sign-On 7.1 for RHEL 7 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el7, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el7
- RHSA-2017:2904 Released 2017-10-17 · Red Hat rating Moderaterh-sso7-keycloak security update
- Red Hat Single Sign-On 7.1 for RHEL 6 Server rh-sso7-keycloak-2.5.14-1.Final_redhat_1.1.jbcs.el6, rh-sso7-keycloak-server-2.5.14-1.Final_redhat_1.1.jbcs.el6
- RHSA-2017:2906 Released 2017-10-17 · Red Hat rating ModerateRed Hat Single Sign-On security update
- Red Hat Single Sign-On 7.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat keycloak — RHSA-2017:2904
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2017-08951 Improper authorization in Red Hat keycloakPriority LOW 35
- TI-2017-08949 Cross-site scripting in Red Hat keycloakPriority LOW 26
- Advisory ·
Red Hat keycloak — RHSA-2017:2905
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2017-08951 Improper authorization in Red Hat keycloakPriority LOW 35
- TI-2017-08949 Cross-site scripting in Red Hat keycloakPriority LOW 26
Show 1 more group
- Advisory ·
Red Hat keycloak — RHSA-2017:2906
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2017-08951 Improper authorization in Red Hat keycloakPriority LOW 35
- TI-2017-08949 Cross-site scripting in Red Hat keycloakPriority LOW 26
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Single Sign-On 7.1 | Fixed | RHSA-2017:2906 |
| Red Hat Single Sign-On 7.1 for RHEL 6 Server | Fixed | RHSA-2017:2904 |
| Red Hat Single Sign-On 7.1 for RHEL 7 Server | Fixed | RHSA-2017:2905 |
Not affected: 1 product
- Red Hat Mobile Application Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12159
- 2026-10-03 Alias added: GHSA-7fmw-85qm-h22p
References
More Red Hat Single Sign On vulnerabilities
- TI-2016-07091 Improper access control in Red Hat Keycloak CVSS 3.0MEDIUM 6.5
- TI-2017-01840 Information disclosure in Red Hat keycloak CVSS 3.0MEDIUM 5.9
- TI-2017-08949 Cross-site scripting in Red Hat keycloak CVSS 3.0MEDIUM 5.4
Sources
- CVE-2017-12159 · CVE Program
- CVE-2017-12159 · NVD
- FIRST EPSS
- GHSA-7fmw-85qm-h22p · GitHub Advisory Database · CC BY 4.0
- CVE-2017-12159 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences