This advisory covers security fixes in the Red Hat build of Keycloak 24.0.7 container images used within OpenShift Container Platform. The fixed vulnerabilities include CVE-2024-7341, a session fixation issue in Elytron SAML adapters; CVE-2024-7318, where One Time Passcodes are valid longer than intended; and CVE-2024-7260, an open redirect vulnerability on the account page. These issues could potentially allow unauthorized session hijacking, OTP misuse, or redirection to malicious sites. The update aligns the container images with the standalone Keycloak product release and is intended for on-premise or private cloud deployments. No CVSS score is provided, but Red Hat rates the severity as moderate.

The vulnerabilities fixed in this update could allow attackers to exploit session fixation, extend the validity of one-time passcodes beyond their expiration, or perform open redirect attacks on the account page. These issues may lead to unauthorized access or phishing risks. However, no known exploits in the wild have been reported. The impact is limited to deployments of the affected Keycloak version within OpenShift Container Platform environments.

Red Hat has released updated container images for Keycloak 24.0.7 that address these vulnerabilities. Users should back up their existing installations, including applications, configuration files, and databases, before applying the update. Applying the updated images will mitigate the session fixation, OTP expiration, and open redirect issues. No additional mitigation steps are indicated by the vendor advisory.