This vulnerability involves a session fixation issue in Keycloak's SAML adapters, where the session ID and JSESSIONID cookie remain unchanged at login time despite the turnOffChangeSessionIdOnLogin option. This flaw enables an attacker who hijacks a session prior to authentication to exploit session fixation. The issue is tracked as CVE-2024-7341 with a CVSS 3.1 score of 7.1 (high severity). Red Hat's advisories for Single Sign-On 7.6.10 on RHEL 7 and 8 include patches that fix this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to hijack a user's session by fixing the session ID before authentication, potentially leading to unauthorized access with high confidentiality, integrity, and availability impact as indicated by the CVSS vector. This could compromise user accounts and sensitive data protected by the affected authentication system.

Red Hat has released security updates for Red Hat Single Sign-On 7.6.10 on RHEL 7 and 8 that address this session fixation vulnerability. Users should apply these updates to remediate the issue. Before applying the update, ensure all previously released errata relevant to the system have been applied. Refer to Red Hat's official advisories and update instructions at https://access.redhat.com/articles/11258 for detailed guidance.