-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 22.0.12 | 22.0.12 |
| org.keycloak:keycloak-services | maven | >= 23.0.0, < 24.0.7 | 24.0.7 |
| org.keycloak:keycloak-services | maven | >= 25.0.0, < 25.0.5 | 25.0.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the changeSessionId function's original implementation which contained dead code - it checked deployment.turnOffChangeSessionIdOnLogin() but returned session.getID() in both code paths. This prevented session ID rotation during authentication even when security configuration required it, enabling session fixation attacks. The commit 2341d6e fixes this by adding proper session.changeID() calls when the security feature is enabled.
A Semantic Attack on Google Gemini - Read the Latest Research