CVE-2019-3868
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with acce…
Published: 2019-04-24 · CVSS: 3.8 · CVSS 3.0
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7