"value":"A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an active Keycloak session by triggering a new authentication process with the query parameter \"prompt=login,\" prompting the user to re-enter their credentials. If the user cancels this re-authentication by selecting \"Restart login,\" an account takeover may occur, as the new session, with a different SUB, will possess the same SID as the previous session."
}
]
},
"problemtype":{
"problemtype_data":[
{
"description":[
{
"lang":"eng",
"value":"Improper Authentication",
"cweId":"CWE-287"
}
]
}
]
},
"affects":{
"vendor":{
"vendor_data":[
{
"vendor_name":"Red Hat",
"product":{
"product_data":[
{
"product_name":"Red Hat build of Keycloak 22",
"version":{
"version_data":[
{
"version_value":"not down converted",
"x_cve_json_5_version_data":{
"versions":[
{
"version":"22.0.10-1",
"lessThan":"*",
"versionType":"rpm",
"status":"unaffected"
}
],
"defaultStatus":"affected"
}
},
{
"version_value":"not down converted",
"x_cve_json_5_version_data":{
"versions":[
{
"version":"22-13",
"lessThan":"*",
"versionType":"rpm",
"status":"unaffected"
}
],
"defaultStatus":"affected"
}
},
{
"version_value":"not down converted",
"x_cve_json_5_version_data":{
"versions":[
{
"version":"22-16",
"lessThan":"*",
"versionType":"rpm",
"status":"unaffected"
}
],
"defaultStatus":"affected"
}
}
]
}
},
{
"product_name":"Red Hat build of Keycloak 22.0.10",
