CVE-2016-8609
Quick assessment
Affected
Red Hat keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat keycloak是美国红帽（Red Hat）公司的一套开源用于现代应用和服务的身份和访问管理软件。 Red Hat keycloak 2.3.0之前版本中存在授权问题漏洞。远程攻击者可利用该漏洞劫持用户会话，造成信息泄露。
Possible ATT&CK Techniques 1 AI
T1565.001 · Stored Data Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2016-8609
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
会话固定
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat keycloak 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat keycloak是美国红帽（Red Hat）公司的一套开源用于现代应用和服务的身份和访问管理软件。 Red Hat keycloak 2.3.0之前版本中存在授权问题漏洞。远程攻击者可利用该漏洞劫持用户会话，造成信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2016-8609
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-8609
请登录查看更多情报信息。
Vendor Advisories for CVE-2016-8609 (4)
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8609 x_refsource_CONFIRM
-
-
-
Same Patch Batch · Red Hat · 2018-08-01 · 6 CVEs total
| CVE-2018-10894 | Red Hat Keycloak 安全漏洞 | |
| CVE-2016-8651 | OpenShift 存在输入验证错误漏洞 | |
| CVE-2016-9579 | Ceph 输入验证错误漏洞 | |
| CVE-2016-8608 | Red Hat JBoss BRMS和BPM Suite 跨站脚本漏洞 | |
| CVE-2016-8653 | RedHat Jboss Fuse和Jboss A-MQ 安全漏洞 |
IV. Related Vulnerabilities
Same product: keycloak
-
CVE-2026-90997
Keycloak-services: keycloak: replay protection bypass leads -
CVE-2026-1609
Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized -
CVE-2025-12150
Org.keycloak/keycloak-services: webauthn attestation stateme -
CVE-2025-13467
Org.keycloak.storage.ldap: keycloak: deserialization of untr -
CVE-2025-11538
Keycloak-server: debug default bind address
Same vendor: Red Hat
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-101295
Oc-mirror: oc-mirror: path traversal / arbitrary file write -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-62146
Cri-o: cri-o: sandbox state poisoning via pod annotations ma
Same weakness: CWE-384
-
CVE-2026-71302
Toptech TMS7 and TopHAT Session Fixation -
CVE-2026-92609
Apache Qpid Broker-J: Missing HTTP-session renewal after suc -
CVE-2026-57179
social-auth-core has a Session Fixation issue -
CVE-2026-95828
Mstfakts College-Management-System Authentication server.php -
CVE-2026-82355
Apache Airflow: Session cookie silently overrides explicit A
V. Comments for CVE-2016-8609
No comments yet