CVE-2024-7341: 
Java vulnerability analysis and mitigation

A session fixation vulnerability (CVE-2024-7341) was discovered in the SAML adapters provided by Keycloak. The vulnerability affects Keycloak versions up to 25.0.2, including Red Hat build of Keycloak and Red Hat Single Sign-On (RHSSO) elytron variants. The issue was disclosed on September 9, 2024, and received a CVSS v3.1 base score of 7.1 (HIGH) (NVD).

The vulnerability occurs because the session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This behavior deviates from the expected security measure where the session ID should be modified during login to change the previous non-authenticated ID to a new one, which helps protect against cookie hijacking (Red Hat Bugzilla).

The vulnerability allows an attacker who successfully hijacks a user's session before authentication to maintain control of that session even after the user authenticates. This creates a session fixation scenario where the attacker can potentially gain unauthorized access to the user's authenticated session (NVD).

Red Hat has released security updates to address this vulnerability across multiple products including Red Hat Single Sign-On 7.6.10 and Red Hat build of Keycloak versions 22.0.12 and 24.0.7. Users are advised to update to the latest versions available through the security advisories (Red Hat Advisory).