Skip to content
fr Sign in
7.5 High

CVE-2026-7507 A session fixation vulnerability was found in Keycloak's login-actions endpoints

Description

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

Affected products and versions

Product Affected versions Fixed in
Red Hat Build of Keycloak Versions not published
Red Hat build of Keycloak 26.2.16 Versions not published
Red Hat build of Keycloak 26.4 26.4 earliest → < 26.4-17 26.4-17
Red Hat build of Keycloak 26.2 26.2 earliest → < 26.2-21 26.2-21
Red Hat build of Keycloak 26.4.12 Versions not published
Red Hat Single Sign-On 7 Versions not published
Red Hat Single Sign-On 7.6.13 Versions not published
RHEL-8 based Middleware Containers 7.6 earliest → < 7.6-85 7.6-85
Red Hat Single Sign-On 7.6 for RHEL 8 Versions not published
Show the 2 other branches
Product Affected versions Fixed in
Red Hat Single Sign-On 7.6 for RHEL 9 Versions not published
Red Hat Single Sign-On 7.6 for RHEL 7 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat Build of Keycloak

The 266 CVEs of Red Hat Build of Keycloak →
CVE-2026-97847 Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority 7.1 High CVE-2026-97175 Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover 8.8 High CVE-2026-97174 Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens 6.8 Medium CVE-2026-96453 Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates 8.0 High
Track this CVE