VDB
CLEANSTART-2026-FA60324
CLEANSTART-2026-FA60324
PUBLISHED
CVSS 9.800000190734863 CRITICAL
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
Risk Scores
CVSS 3.0
9.800000190734863
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| CleanStart | keycloak | 0 |
Timeline
- Apr 14, 2026 CVE Updated
- Apr 15, 2026 CVE Published
References
- https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-FA60324.json advisory
- https://osv.dev/vulnerability/CVE-2017-12158 url
- https://osv.dev/vulnerability/CVE-2017-12159 url
- https://osv.dev/vulnerability/ghsa-3p8m-j85q-pgmj url
- https://osv.dev/vulnerability/ghsa-45p5-v273-3qqr url
- https://osv.dev/vulnerability/ghsa-4cx2-fc23-5wg6 url
- https://osv.dev/vulnerability/ghsa-5rfx-cp42-p624 url
- https://osv.dev/vulnerability/ghsa-72hv-8253-57qq url
- https://osv.dev/vulnerability/ghsa-84h7-rjj3-6jx4 url
- https://osv.dev/vulnerability/ghsa-9342-92gg-6v29 url
- https://osv.dev/vulnerability/ghsa-cbdj-484d-3x9q url
- https://osv.dev/vulnerability/ghsa-fghv-69vj-qj49 url
- https://osv.dev/vulnerability/ghsa-h5fg-jpgr-rv9c url
- https://osv.dev/vulnerability/ghsa-hq9p-pm7w-8p54 url
- https://osv.dev/vulnerability/ghsa-j288-q9x7-2f5v url
- https://osv.dev/vulnerability/ghsa-pwqr-wmgm-9rr8 url
- https://osv.dev/vulnerability/ghsa-w9fj-cfpg-grvv url
- https://nvd.nist.gov/vuln/detail/CVE-2017-12158 url
- https://nvd.nist.gov/vuln/detail/CVE-2017-12159 url