CVE-2019-3868

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-3868
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3868.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-3868
Aliases
Downstream
Published
2019-04-24T16:29:02.373Z
Modified
2026-07-22T03:44:51.396631Z
Severity
  • 3.8 (Low) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

References

Affected packages

Git / github.com/keycloak/keycloak

Affected ranges

Type
GIT
Repo
https://github.com/keycloak/keycloak
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b60c6d72270e814883631352805348a9d462e8a1
Database specific 
{
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0.0"
        }
    ],
    "cpe": "cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*"
}

Affected versions

1.*
1.0-alpha-1
1.0-alpha-1-12062013
1.0-alpha-2
1.0-alpha-3
1.0-beta-1
1.0-beta-2
1.0-beta-4
1.0-final
1.0-rc-1
1.0.0.Final
1.1.0.Beta2
1.3.0.Final
2.*
2.4.0.Test
6.*
6.0.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3868.json"