EUVD-2026-30889
GHSA-hf67-5vvq-fm3r
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1Blast Radius
ecosystem impact- 61 maven packages depend on org.keycloak:keycloak-services (28 direct, 33 indirect)
Ecosystem-wide dependent count for version 26.6.2.
DescriptionCVE.org
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint-which processes session handles without adequate CSRF protection or cookie ownership validation-an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
AnalysisAI
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take over accounts, including highly privileged administrative ones. Exploitation requires the victim to click an attacker-crafted link, after which an existing SSO session causes transparent authentication into the attacker-controlled flow. No public exploit identified at time of analysis, but Red Hat has confirmed the flaw in Red Hat Build of Keycloak.
Technical ContextAI
Keycloak is an open-source identity and access management solution that handles authentication flows through stateful session handles. The /login-actions/restart endpoint manages authentication session state and, per the advisory, lacks adequate CSRF protection and cookie ownership validation, allowing an unauthenticated party to pre-create an authentication session and bind it to a victim. This is a CWE-290 (Authentication Bypass by Spoofing) class issue rooted in trusting session handles without verifying that the browser cookie and the session identifier belong to the same principal, which is the canonical pattern for session fixation against federated/SSO front-ends.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7507 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2464145 for the fixed Red Hat Build of Keycloak release and apply it as soon as published. Until a patched build is available, compensating controls include restricting administrative console access to trusted networks or VPN-only reachability to keep /login-actions/* off the public internet, enforcing step-up authentication or admin-console-only client policies so that an SSO cookie alone cannot complete privileged required-action flows, and reducing SSO session lifetimes and idle timeouts so victims are less likely to have a live session when clicking a malicious link; each of these reduces convenience for legitimate users (extra logins, VPN dependency) but materially narrows the window for the fixation attack. Operationally, alert on anomalous traffic to /login-actions/restart with externally-supplied session handles and on required-action completions tied to mismatched cookies and source IPs.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today