CVE-2016-8609
—CVSS 3.0
8.1 high
EPSS
2%p76
Published
()
Modified
Description
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
- Vendors
- redhat
- Products
- keycloak
- Weakness
- CWE-384, CWE-287
- Vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
In the news0 stories
No ingested article mentions this CVE yet.