EUVD-2026-30889
GHSA-hf67-5vvq-fm3r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify Keycloak realm and admin target
-
DeliveryPre-create authentication session via login-actions
-
ExploitDeliver crafted /login-actions/restart link to victim
-
InstallVictim with active SSO cookie clicks link
-
C2Keycloak resets flow and authenticates victim into attacker session
-
ExecuteAttacker completes required-action form as victim
-
ImpactFull account or admin takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the target Keycloak realm to use SSO such that the victim already holds a valid session cookie when clicking the link, (2) the attacker to pre-create an authentication session and obtain its handle via the public /login-actions endpoints, and (3) the victim to click an attacker-crafted /login-actions/restart URL containing that handle (UI:R). Limiting factors include the CVSS high attack complexity (AC:H) - the attacker must time the link delivery to a window where the victim has an active SSO session - the dependency on user interaction with a crafted link, and the need for the victim's account to actually hold privileges worth hijacking (admin takeover only applies if a victim with admin rights is phished). No special non-default configuration is named in the description; the vulnerable endpoint is part of the standard login-actions flow. |
| Impact | The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.5 (High): network-reachable and unauthenticated, but with high attack complexity and required user interaction (the victim must click a crafted link while holding an active SSO session). EPSS data was not provided and the CVE is not listed in CISA KEV, so there is no evidence of widespread exploitation; nonetheless, the impact is severe because successful exploitation enables full account takeover up to administrator level on a central identity provider, which is a high-leverage target. The AC:H rating reflects the timing/state requirements (pre-created session, victim with valid SSO), so real-world risk skews toward targeted phishing against admin users of internet-exposed Keycloak deployments rather than mass exploitation. |
| Exploit ScenarioDerived | An attacker browses to a target Keycloak deployment, initiates an authentication flow to obtain a session handle, and crafts a /login-actions/restart link embedding that handle, which they deliver to an administrator via phishing. When the admin (already holding a valid SSO cookie for the realm) clicks the link, Keycloak resets the flow state, transparently authenticates the victim into the attacker-prepared session, and presents the required-action form, which the attacker then completes from their own browser to assume the admin's identity. No public exploit identified at time of analysis, but the attack primitives (link delivery plus a live SSO cookie) are well within reach of an unauthenticated remote actor running a targeted phishing campaign. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take over accounts, including highly privileged administrative ones. Exploitation requires the victim to click an attacker-crafted link, after which an existing SSO session causes transparent authentication into the attacker-controlled flow. No public exploit identified at time of analysis, but Red Hat has confirmed the flaw in Red Hat Build of Keycloak.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7507 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2464145 for the fixed Red Hat Build of Keycloak release and apply it as soon as published. Until a patched build is available, compensating controls include restricting administrative console access to trusted networks or VPN-only reachability to keep /login-actions/* off the public internet, enforcing step-up authentication or admin-console-only client policies so that an SSO cookie alone cannot complete privileged required-action flows, and reducing SSO session lifetimes and idle timeouts so victims are less likely to have a live session when clicking a malicious link; each of these reduces convenience for legitimate users (extra logins, VPN dependency) but materially narrows the window for the fixation attack. Operationally, alert on anomalous traffic to /login-actions/restart with externally-supplied session handles and on required-action completions tied to mismatched cookies and source IPs.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in maven
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Keycloak is an open-source identity and access management solution that handles authentication flows through stateful session handles. The /login-actions/restart endpoint manages authentication session state and, per the advisory, lacks adequate CSRF protection and cookie ownership validation, allowing an unauthenticated party to pre-create an authentication session and bind it to a victim. This is a CWE-290 (Authentication Bypass by Spoofing) class issue rooted in trusting session handles without verifying that the browser cookie and the session identifier belong to the same principal, which is the canonical pattern for session fixation against federated/SSO front-ends.
Know when Red Hat Build Of Keycloak gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint-which processes session handles without adequate CSRF protection or cookie ownership validation-an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
Blast Radius
ecosystem impact- 61 maven packages depend on org.keycloak:keycloak-services (28 direct, 33 indirect)
Ecosystem-wide dependent count for version 26.6.2.
Executive ViewAI
A session fixation vulnerability in Red Hat Build of Keycloak (CVE-2026-7507) enables attackers to hijack authenticated user sessions and take over accounts, including administrative ones, by tricking users into clicking malicious links that exploit existing SSO sessions. With no vendor patch currently available, this creates immediate risk to account security and privileged administrative access. Organizations must implement compensating controls urgently and monitor Red Hat advisories for patch availability.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Enforce strict session timeouts to minimize active session exposure; (2) Require multi-factor authentication for all administrative and privileged accounts; (3) Implement network-level access controls to restrict login-actions endpoints to trusted networks; (4) Monitor session logs and alert on anomalous authentication patterns; (5) Conduct user security awareness training to prevent clicking untrusted authentication links.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Mismatched handling of the HTTP/1 absolute-form request authority in Red Hat build of Quarkus and other affected Red Hat
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Exploit-DB