Aller au contenu
en Se connecter
7.5 Élevée

CVE-2026-7507 A session fixation vulnerability was found in Keycloak's login-actions endpoints

Description

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Build of Keycloak Versions non publiées
Red Hat build of Keycloak 26.2.16 Versions non publiées
Red Hat build of Keycloak 26.4 26.4 premières → < 26.4-17 26.4-17
Red Hat build of Keycloak 26.2 26.2 premières → < 26.2-21 26.2-21
Red Hat build of Keycloak 26.4.12 Versions non publiées
Red Hat Single Sign-On 7 Versions non publiées
Red Hat Single Sign-On 7.6.13 Versions non publiées
RHEL-8 based Middleware Containers 7.6 premières → < 7.6-85 7.6-85
Red Hat Single Sign-On 7.6 for RHEL 8 Versions non publiées
Afficher les 2 autres branches
Produit Versions touchées Corrigé en
Red Hat Single Sign-On 7.6 for RHEL 9 Versions non publiées
Red Hat Single Sign-On 7.6 for RHEL 7 Versions non publiées

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Build of Keycloak

Les 276 CVE de Red Hat Build of Keycloak →
CVE-2026-9797 Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator 6.5 Moyenne CVE-2026-97848 Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization 6.5 Moyenne CVE-2026-97367 Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover 6.4 Moyenne CVE-2026-96547 Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles 6.5 Moyenne
Suivre cette CVE