CVE-2023-6787Keycloak session hijack via prompt=login re-authentication
What broke
Keycloak's re-authentication path (prompt=login) could attach a new login to someone else's active session. A session that looked like step-up was a session hijack. Assigned CVE-2023-6787, public with the April 2024 Keycloak/RHSA train (alongside CVE-2023-6544 and CVE-2023-6717).
Why it matters
prompt=login is how apps force a fresh password or MFA. If that flow can steal a session, step-up is an attack. Same class as Citrix Bleed: the session is the credential.
What to do
- Upgrade Keycloak to the April 2024 patched line or later.
- After upgrade, invalidate sessions if the realm was public while vulnerable.
- Confirm step-up still binds to the existing
suband does not mint a new session for a different user.
After you patch
Token-layer flaws produce credentials that keep working after the patch, so remediation is about invalidating what was issued.
- Rotate the signing keys published at your JWKS endpoint, then confirm relying parties refetch on an unknown key id rather than caching indefinitely.
- Revoke refresh tokens and sessions. Access tokens expire on their own; refresh tokens are the ones that turn a short compromise into months of access.
- Audit client registrations and consent grants created during the window, particularly any client with broad scopes or a redirect URI you do not recognize.
- Verify validation on your side: pinned algorithms, issuer and audience checks, and no acceptance of
alg: none. See JWT and the validate a JWT recipe.
Sources
- NVD: CVE-2023-6787
- GitHub GHSA-c9h6-v78w-52wj / Red Hat RHSA-2024:1868
Related identity CVEs
Related on Start with Identity
- CVEKeycloak SAML broker assertion replay, session hijack
Keycloak's SAML broker accepted a replayed assertion and hijacked a user session. An authentication bypass on the broker edge. Patched in the 2026 Keycloak SAML
- CVEKeycloak accepts SAML from a disabled identity provider
A remote attacker can complete a broker login with a valid SAML response even after the SAML IdP is disabled in Keycloak. Unauthorized authentication via a cont
- CVEKeycloak Admin API auth bypass to custom attributes
Keycloak's Admin API let a caller read sensitive custom attributes they should not have seen (CWE-266). An authorization hole on the admin plane.
- GlossaryAuthorization Code Flow
The recommended OAuth 2.0 flow for apps with a user: the app receives a short-lived code, then exchanges it for tokens from a back channel. Combined with PKCE f
- GlossaryCIBA
Client-Initiated Backchannel Authentication. An OpenID Connect flow where authentication is initiated on one device and approved on another, useful for call cen
- GlossaryClaims
Statements about a subject carried in a token, such as subject identifier, email, roles, or expiry. Relying parties make authorization decisions from claims, so
Technique
This CVE is an instance of Session cookie theft. A session cookie is a bearer credential that proves nothing beyond possession. Whoever copies it inherits the logged-in session, skipping the password and the MFA challenge that produced it.