Keycloak Insufficient Session Expiry

2022-05-2417:17:37

Google

osv.dev

6.1 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

22.9%

JSON

A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.

CPENameOperatorVersion
org.keycloak:keycloak-coreeq1.9.4.Final
org.keycloak:keycloak-coreeq1.9.8.Final
org.keycloak:keycloak-coreeq4.8.3.Final
org.keycloak:keycloak-coreeq3.4.1.Final
org.keycloak:keycloak-coreeq3.2.1.Final
org.keycloak:keycloak-coreeq1.0.4.Final
org.keycloak:keycloak-coreeq3.4.3.Final
org.keycloak:keycloak-coreeq6.0.0
org.keycloak:keycloak-coreeq1.0.3.Final
org.keycloak:keycloak-coreeq5.0.0

Name	Operator	Version
org.keycloak:keycloak-core	eq	1.9.4.Final
org.keycloak:keycloak-core	eq	1.9.8.Final
org.keycloak:keycloak-core	eq	4.8.3.Final
org.keycloak:keycloak-core	eq	3.4.1.Final
org.keycloak:keycloak-core	eq	3.2.1.Final
org.keycloak:keycloak-core	eq	1.0.4.Final
org.keycloak:keycloak-core	eq	3.4.3.Final
org.keycloak:keycloak-core	eq	6.0.0
org.keycloak:keycloak-core	eq	1.0.3.Final
org.keycloak:keycloak-core	eq	5.0.0