Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-24456 EUVD-2023-0427GHSA-9963-gmh8-vvm6

Session fixation vulnerability in Jenkins Keycloak Authentication Plugin

Published Jan 24, 2023 · Updated Apr 2, 2025 · Assigned by jenkins

Vendor: Jenkins Project Product: Jenkins Keycloak Authentication Plugin Package: org.jenkins-ci.plugins:keycloak Category: Web / CMS Ecosystem: Maven

Description

Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.

Affected products

VendorProductAffectedFixed
Jenkins Project Jenkins Keycloak Authentication Plugin unspecified – ≤ 2.3.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.jenkins-ci.plugins:keycloak < 2.3.1 2.3.1 GHSA-9963-gmh8-vvm6

Advisories 1

References