CVE-2021-3461: 
Java vulnerability analysis and mitigation

A security vulnerability (CVE-2021-3461) was identified in Keycloak where the system may fail to properly logout user sessions when the logout request originates from an external SAML identity provider and the Principal Type is set to Attribute [Name]. This vulnerability affects Red Hat Single Sign-On 7.4 and Keycloak version 9.0.13 (Red Hat Advisory, NVD).

The vulnerability is classified as CWE-613 (Insufficient Session Expiration) with a CVSS v3.1 base score of 7.1 (HIGH). The vulnerability vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. The issue specifically occurs in the keycloak-services jar within the SAMLEndpoint class (Red Hat Bugzilla).

When exploited, this vulnerability could lead to insufficient session expiration, potentially allowing unauthorized access to user sessions when specific SAML identity provider configurations are in place. The vulnerability affects the confidentiality and integrity of the system, though availability is not impacted (NVD).

Red Hat has addressed this vulnerability by releasing security updates for affected versions. The fix was included in Red Hat Single Sign-On 7.4.7 and Keycloak 9.0.13. Users are advised to upgrade to these versions or later (Red Hat Advisory).

The vulnerability was discovered and reported by Peter Mazán from TatraMed Software (Red Hat Bugzilla).