Vulnerability

CVE-2024-7341

High· 7.1CVSS7.1EPSS1%

.rules3/5

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an att

Threat signal

75/100

High

Severity

high

CVSS

7.1

EPSS

Active

CVSS

v3.1via NVDOpen in FIRST calculator →

7.1/ 10HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack VectorNetworkExploitable remotely over the internet — no local access needed.
Attack ComplexityHighRequires conditions outside attacker's control (race, brute-force, configuration
Privileges RequiredLowStandard user privileges sufficient.
User InteractionRequiredRequires user action (click, file open, etc).
ScopeUnchangedImpact contained to the vulnerable component.
Confidentiality ImpactHighTotal disclosure of sensitive data.
Integrity ImpactHighTotal compromise of integrity — full data modification possible.
Availability ImpactHighTotal loss of availability — full DoS possible.

EPSS

Exploit prediction · 30-day horizonFIRST.org →

0.85%

probability of exploitation in next 30 days

p57

higher than 57% of all CVEs

8-day trend↑ 0pp

Low exploitation likelihood — defer if no other signals fire.

Vendor VEX

No VEX statements published for CVE-2024-7341. Vendors publish VEX (Vulnerability Exploitability eXchange) to assert per-product whether a CVE is actually exploitable in their distribution.

SSVCTrack

Total impact on non-trivial mission systems

exploitation: none
automatable: no
impact: total
mission: support

Lifecycle

2024-09-09Published
2026-08-27Last modified1 source

CVE-2024-7341

CVSS

EPSS

Vendor VEX

Lifecycle

References

CVE-2024-7341

CVSS

EPSS

Vendor VEX

Lifecycle

References