High severity · published Oct 26, 2017
CVE-2017-12159
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
7.5
CVSS
2.7%
EPSS
No
On KEV
Description
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Keycloak · Keycloak
All versions, or not specified · source: NVD
SS
Single Sign ON · Redhat
7.0; 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12159
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12159
Third Party Advisory
http://www.securityfocus.com/bid/101601
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2904
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2905
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:2906
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1484111
More from Keycloak
8.8
CVE-2017-12161
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request
8.8
CVE-2014-3709
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)…
8.1
CVE-2026-1609
Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
7.5
CVE-2014-3651
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR…
7.4
CVE-2026-90997
Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch