Improper Authentication in org.keycloak:keycloak-core

published 2018-08-01 8 y ago modified 2026-06-17 4 mo ago also GHSA-95m6-mjh3-58gm , EUVD-2018-0559

cvss: 3.7; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.7%; EPSS 1.7% chance of exploitation in 30 days, percentile 77%
public exploits: 0; none known

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.

Patch / fix

fixed in 2

maven org.keycloak:keycloak-core 2.3.0
redhat keycloak 2.3.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-8609 updated 2026-06-30 cvss 3.7

keycloak: account hijacking via auth code fixation

Red Hat Single Sign-On 7.0
fixed: vendor fix RHSA-2016:2945
Red Hat Single Sign-On 7 rh-sso7-keycloak rh-sso7-keycloak
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.68% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
NVD	3.0	8.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub	3.0	8.1	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
maven	org.keycloak:keycloak-core	<2.3.0	2.3.0

Affected products

Red Hat keycloak

Classification

Weakness

CWE-384 Session Fixation
CWE-287 Improper Authentication

References

rhn.redhat.com /errata/RHSA-2016-2945.html
vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8609
issue-tracking, vendor-advisory
securitytracker.com /id/1037460
vdb-entry, third-party-advisory
securityfocus.com /bid/95070
vdb-entry, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2016-8609
advisory
github.com /advisories/GHSA-95m6-mjh3-58gm
advisory

Sources

CVE List CVE-2016-8609
GitHub Advisory GHSA-95m6-mjh3-58gm
NVD CVE-2016-8609

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary