The Red Hat build of Keycloak 24.0.7 update addresses three security issues: CVE-2024-7260 is an open redirect vulnerability on the Account page, which could allow redirection to untrusted URLs. CVE-2024-7318 involves One Time Passcodes (OTP) remaining valid longer than their intended expiration time, potentially weakening authentication controls. CVE-2024-7341 is a session fixation vulnerability in Elytron SAML adapters, which could allow an attacker to fixate a session identifier and hijack user sessions. These issues are fixed in the updated Red Hat build of Keycloak 24.0.7 packages.

The vulnerabilities could allow attackers to perform open redirect attacks, exploit extended OTP validity to bypass intended authentication timing controls, and hijack user sessions via session fixation. While no known exploits are reported in the wild, these issues could undermine authentication and session security in affected Keycloak deployments, potentially impacting confidentiality and integrity of user sessions.

Red Hat has released an official update to the build of Keycloak version 24.0.7 that addresses these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying this update is the recommended remediation. No additional vendor advisories indicate alternative mitigations or that these issues are already mitigated without patching.