CVE-2024-7341: Redhat Keycloak Auth Bypass Vulnerability

CVE-2024-7341 Overview

CVE-2024-7341 is a session fixation vulnerability in the SAML adapters shipped with Red Hat Keycloak. The SAML adapters fail to rotate the session ID and JSESSIONID cookie during authentication, even when the turnOffChangeSessionIdOnLogin option is explicitly configured. An attacker who obtains a victim's pre-authentication session identifier can retain access to that same session after the victim authenticates. The flaw is tracked under CWE-384: Session Fixation.

Critical Impact
A successful attacker inherits the authenticated victim's session, gaining full access to protected applications and their data through the Keycloak SAML single sign-on flow.

Affected Products

Red Hat Keycloak (SAML adapters)
Red Hat Single Sign-On
Red Hat Build of Keycloak
Red Hat Enterprise Linux 7, 8, and 9 (packages providing the SAML adapters)

Discovery Timeline

2024-09-09 - CVE-2024-7341 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2024-7341

Vulnerability Analysis

The vulnerability lives in the SAML client adapters that Keycloak provides for integrating downstream applications with the Keycloak identity provider. When a user first contacts a protected application, the servlet container issues a session with a JSESSIONID cookie. After the SAML authentication assertion is validated, the adapter should invalidate the anonymous session and issue a new session identifier to bind the authenticated principal to a fresh session.

The affected adapters do not perform this rotation. The pre-authentication session identifier remains valid after login and continues to represent the authenticated user. Even setting turnOffChangeSessionIdOnLogin to a non-default value does not force the expected rotation, contradicting the documented behavior.

Root Cause

The root cause is missing session identifier regeneration at the SAML authentication boundary. Standard defense against session fixation requires the application to call the servlet container's session invalidation and re-creation routines after a successful authentication. The Keycloak SAML adapter code path skips this step, and the configuration flag intended to control the behavior is not honored consistently.

Attack Vector

Exploitation requires an attacker to plant a known session identifier in the victim's browser before authentication. Typical delivery involves a related-domain cookie injection, a network position that allows setting cookies over cleartext channels, or a cross-site scripting flaw in a sibling application. The attacker then waits for the victim to authenticate through the SAML flow to Keycloak. Because the session ID is not rotated, the attacker's cached JSESSIONID becomes an authenticated session for the victim's identity. User interaction is required, and the attack complexity is high, which limits opportunistic mass exploitation but does not prevent targeted abuse.

No verified exploit code is publicly available. See the
Red Hat advisory linked below for authoritative technical detail.

Detection Methods for CVE-2024-7341

Indicators of Compromise

Authenticated sessions whose JSESSIONID value is identical to a JSESSIONID observed before the SAML AuthnResponse was processed.
SAML assertion consumption events immediately followed by application activity under a session ID that predates the authentication event.
Multiple client IP addresses or user-agent strings sharing the same JSESSIONID during a single authenticated session lifetime.

Detection Strategies

Correlate access logs from applications behind Keycloak SAML adapters to flag any session ID that transitions from anonymous to authenticated state without a rotation event.
Alert on SAML SSO logins where the post-login session identifier matches a session identifier from a different source IP within the prior 30 minutes.
Review adapter logs for the presence or absence of session-invalidation entries surrounding successful SAML assertion processing.

Monitoring Recommendations

Ingest Keycloak adapter and application server access logs into a centralized analytics platform for cross-session correlation.
Track distributions of session identifier reuse across authentication boundaries as a baseline for anomaly detection.
Monitor for cookie-injection precursors such as unexpected Set-Cookie headers on cleartext responses in related domains.

How to Mitigate CVE-2024-7341

Immediate Actions Required

Apply the fixed Keycloak, Red Hat Single Sign-On, or Red Hat Build of Keycloak packages published in the RHSA advisories listed below.
Terminate all active SAML sessions after patching to invalidate any session identifiers that may already be under attacker control.
Enforce HTTPS end-to-end for all applications protected by SAML adapters to prevent trivial cookie planting over cleartext.

Patch Information

Red Hat issued a coordinated set of errata addressing CVE-2024-7341 across supported product streams. See Red Hat Security Advisory RHSA-2024:6493, RHSA-2024:6494, RHSA-2024:6495, RHSA-2024:6497, RHSA-2024:6499, RHSA-2024:6500, RHSA-2024:6501, RHSA-2024:6502, and RHSA-2024:6503. Additional detail is available in the Red Hat CVE-2024-7341 advisory and the GitHub Advisory GHSA-j76j-rqwj-jmvv.

Workarounds

Configure the application server or reverse proxy to force session invalidation and re-issuance after SAML authentication completes.
Set the Secure, HttpOnly, and SameSite=Lax or Strict attributes on JSESSIONID cookies to reduce the attack surface for cookie planting.
Restrict application cookies to a single fully-qualified domain to prevent related-domain injection from adjacent hosts.

bash

# Example JBoss/WildFly undertow snippet to enforce secure session cookies
/subsystem=undertow/servlet-container=default/setting=session-cookie:add(\
  http-only=true, secure=true, name=JSESSIONID)