8000 Better check for authSessionCookie in SessionCodeChecks by rmartinc · Pull Request #49134 · keycloak/keycloak · GitHub
[go: up one dir, main page]
Skip to content

Better check for authSessionCookie in SessionCodeChecks - #49134

Merged
stianst merged 1 commit into
keycloak:mainfrom
rmartinc:issue-49111
May 20, 2026
Merged

Better check for authSessionCookie in SessionCodeChecks#49134
stianst merged 1 commit into
keycloak:mainfrom
rmartinc:issue-49111

Conversation

@rmartinc
@rmartinc rmartinc commented May 19, 2026
Copy link
Copy Markdown
Contributor

Closes CVE-2026-7507
Closes #49111

Backport to main.

@rmartinc
rmartinc requested review from a team as code owners May 19, 2026 17:09
@keycloak-github-bot
keycloak-github-bot Bot commented May 19, 2026
Copy link
Copy Markdown

Unreported flaky test detected

If the flaky tests below are affected by the changes, please review and update the changes accordingly. Otherwise, a maintainer should report the flaky tests prior to merging the PR.

org.keycloak.testsuite.forms.RegisterTest#registerUserSuccess_emailAsUsername

Keycloak CI - Forms IT (chrome)

java.lang.IllegalArgumentException: No enum constant org.keycloak.testsuite.pages.AppPage.RequestType.localhost
	at java.base/java.lang.Enum.valueOf(Enum.java:293)
	at org.keycloak.testsuite.pages.AppPage$RequestType.valueOf(AppPage.java:58)
	at org.keycloak.testsuite.pages.AppPage.getRequestType(AppPage.java:47)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
...

Report flaky test

keycloak-github-bot[bot]
keycloak-github-bot Bot reviewed May 19, 2026
View reviewed changes
@keycloak-github-bot keycloak-github-bot Bot left a comment
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unreported flaky test detected, please review

@stianst
stianst merged commit d791b27 into keycloak:main May 20, 2026
87 checks passed
@stianst stianst mentioned this pull request Jun 1, 2026
Closed
sashyo pushed a commit to tide-foundation/keycloak-IGA that referenced this pull request Jul 20, 2026
@rmartinc @sashyo
Better check for authSessionCookie in SessionCodeChecks (keycloak#603) (
26df0b2 
keycloak#49134)

Closes CVE-2026-7507
Closes keycloak#49111

Signed-off-by: rmartinc <rmartinc@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@stianst stianst stianst approved these changes
+1 more reviewer
@keycloak-github-bot keycloak-github-bot[bot] keycloak-github-bot[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

flaky-test team/cloud-native team/core-clients team/core-iam

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover

2 participants

@rmartinc @stianst
0