CVE-2023-24456 Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login

Description

Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.

Affected products and versions

Product	Affected versions	Fixed in
Jenkins Keycloak Authentication Plugin 2.3	earliest → 2.3.0	No fix stated

Other CVEs of Jenkins Keycloak Authentication Plugin

The 3 CVEs of Jenkins Keycloak Authentication Plugin →

CVE-2026-92141 Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing… 4.3 Medium CVE-2023-24457 A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows… 6.5 Medium