CVE-2023-6787: 
Java vulnerability analysis and mitigation

A vulnerability (CVE-2023-6787) was discovered in Keycloak's re-authentication mechanism within org.keycloak.authentication. The flaw was disclosed on April 25, 2024, and affects Keycloak's session management functionality. This security issue enables potential session hijacking through manipulation of the authentication process (NVD, Red Hat CVE).

The vulnerability occurs when an attacker triggers a new authentication process using the query parameter 'prompt=login' on an active Keycloak session. If a user cancels the re-authentication by selecting 'Restart login', an account takeover becomes possible as the new session, despite having a different SUB (subject identifier), maintains the same SID (session ID) as the previous session. The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, indicating network accessibility, low attack complexity, and high impact on integrity (NVD).

The primary impact of this vulnerability is the potential for account takeover through session hijacking. An attacker can manipulate the authentication process to gain unauthorized access to user accounts, compromising the integrity of the authentication system. The vulnerability affects the session management security of Keycloak, potentially exposing users to unauthorized access (Red Hat CVE).

Red Hat has addressed this vulnerability in Red Hat build of Keycloak 22.0.10 through security updates RHSA-2024:1867 and RHSA-2024:1868. Users are advised to update to the fixed versions to mitigate the vulnerability (Red Hat Advisory).