PT-2017-12374 · Red Hat · Keycloak

Published 2017-10-26 · Updated 2026-05-18 · CVE-2017-12159

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw was found in Keycloak's CSRF prevention mechanism, where the cookie used was not unique to each session. This could allow an attacker to gain access to an authenticated user's session, potentially leading to information disclosure or further attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CLEANSTART-2026-FA60324

CLEANSTART-2026-GX01236

CLEANSTART-2026-KC06018

CLEANSTART-2026-PO27799

CLEANSTART-2026-SG80587

CVE-2017-12159

GHSA-7FMW-85QM-H22P

RHSA-2017:2904

RHSA-2017:2905

Affected Products

Keycloak

References · 86

• https://nvd.nist.gov/vuln/detail/CVE-2026-42577 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2905 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-KC06018 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5588 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-5598 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42580 · Security Note
• https://access.redhat.com/errata/RHSA-2017:2904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41417 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12158 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12159 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42584 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42587 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12159 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42581 · Security Note