CVE-2024-7341 is a session fixation flaw in the SAML adapters provided by Keycloak. It is rated High (CVSS 7.1). The session ID does not change at login, even with a certain option set. Red Hat's advisory for Single Sign-On 7.6 on RHEL 7 ships the fix as Keycloak 18.0.16-1.
What's affected
The NVD record lists Red Hat Keycloak, Red Hat Single Sign-On, and Red Hat Enterprise Linux 7 and 8 as affected products. It describes the problem this way: the session ID and the JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. An attacker who hijacks the current session before authentication can then trigger session fixation.
The Red Hat advisory I could read, RHSA-2024:6493, covers Red Hat Single Sign-On 7.6 for RHEL 7. It replaces Single Sign-On 7.6.9 and lists these fixed packages at version 18.0.16-1.redhat_00001.1.el7sso:
- rh-sso7-keycloak
- rh-sso7-keycloak-server
The advisory titles the fix as session fixation in the elytron saml adapters, and tracks it as BZ-2302064 in the org.keycloak/keycloak-services component. Red Hat issued five more errata for this CVE (RHSA-2024:6494, 6495, 6497, 6499 and 6500). I did not read those, so the fixed builds for other products and platforms need to be taken from the matching advisory.
On severity, the record gives High at 7.1. The Red Hat advisory rates the overall update Moderate and does not list a separate score for this CVE. Those are different things, since an advisory rating covers the whole update, but plan around the CVSS score.
How to check if you're exposed
First, find out whether you use the SAML adapters at all. These are libraries or modules loaded into an application that relies on Keycloak for SAML login. A Keycloak server that only does OpenID Connect does not use them. Search your applications for Keycloak SAML adapter dependencies in your build files and deployment directories.
For Red Hat Single Sign-On on RHEL 7, list the installed package version.
rpm -qa | grep rh-sso7-keycloak
Compare the output with 18.0.16-1. For other releases, follow the relevant Red Hat errata. A dependency scan of your applications will also show where an adapter library is bundled.
What to do now
- Identify applications that use Keycloak SAML adapters, including those packaged inside application servers.
- Apply the Red Hat errata that matches your product and platform, such as RHSA-2024:6493 for Single Sign-On 7.6 on RHEL 7.
- Redeploy the applications that bundle the adapter, since a server package update alone may not replace an adapter inside an app.
- Do not rely on the
turnOffChangeSessionIdOnLoginsetting as a protection. The record says the session ID stays the same even with that option configured. - Run a scan to map where the libraries live. The free in-browser dependency scan at gold.safeguard.sh/scan is a fast first pass, and reachability analysis helps rank what to fix first.
Why it matters
The weakness is CWE-384, session fixation. A safe login system issues a fresh session identifier once a user proves who they are. If the old identifier survives, anyone who planted or learned it before login holds a valid session afterward. That is why changing the ID at login is standard practice.
The attack is not trivial. The CVSS vector marks attack complexity High and user interaction Required, which is why the score is 7.1 and not higher. Still, the impact ratings are High across confidentiality, integrity and availability, because a hijacked authenticated session carries the victim's rights. The KEV flag is false, and nothing I read reports exploitation.
Quick check
Does this affect Keycloak servers that only use OpenID Connect?
The record describes the flaw in the SAML adapters. Check your applications for those adapters, and read the Red Hat advisory for your product to confirm scope.
Is the turnOffChangeSessionIdOnLogin option a mitigation?
No. The record says the session ID is not changed at login even when that option is configured.
Sources
Last reviewed: 19 October 2026.
