CVE-2019-3868

LowCVSS 3.8/10Last modified Jun 17, 2026

Description

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

Metrics

CVSS 3.0 3.8/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Red Hat	keycloak	affects up to 6.0.0 version

References

http://www.securityfocus.com/bid/108061Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140
https://access.redhat.com/errata/RHSA-2019:2998
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/108061Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1140
https://access.redhat.com/errata/RHSA-2019:2998
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3868Issue Tracking, Vendor Advisory

Timeline

Published: Apr 24, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38697.2When running Tower before 3.4.3 on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variabl CVE-2019-38706.1A vulnerability was found in Samba from version (including) 4.9 to versions before 4.9.6 and 4.10.2. During the creation of a new Samba AD D CVE-2019-38718.8A vulnerability was found in PowerDNS Authoritative Server before 4.0.7 and before 4.1.7. An insufficient validation of data coming from the CVE-2019-38725.4It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x an CVE-2019-38739.0It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XM CVE-2019-38746.5The SCTP socket buffer used by a userspace application is not accounted by the cgroups subsystem. An attacker can use this flaw to cause a d CVE-2019-38754.8A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL CVE-2019-38766.3A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to CVE-2019-38776.1A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass thr CVE-2019-38788.1A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to CVE-2019-38798.1It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the pe CVE-2019-38805.4A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use