Keycloak Session Fixation Vulnerability Allowing Session Takeover

A session fixation vulnerability has been identified in Keycloak. This issue allows a user to unintentionally access another user's session when both users are on the same device and browser. The vulnerability arises because Keycloak occasionally reuses session identifiers and fails to properly clear sessions during logout when browser cookies are absent. Consequently, one user may receive tokens that are intended for another user.

Impact

Exploitation of this vulnerability could lead to unauthorized access to another user's session, allowing the attacker to assume the identity of that user.