EUVD-2026-30889
GHSA-hf67-5vvq-fm3r
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1Blast Radius
ecosystem impact- 61 maven packages depend on org.keycloak:keycloak-services (28 direct, 33 indirect)
Ecosystem-wide dependent count for version 26.6.2.
DescriptionCVE.org
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint-which processes session handles without adequate CSRF protection or cookie ownership validation-an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
AnalysisAI
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take over accounts, including highly privileged administrative ones. Exploitation requires the victim to click an attacker-crafted link, after which an existing SSO session causes transparent authentication into the attacker-controlled flow. No public exploit identified at time of analysis, but Red Hat has confirmed the flaw in Red Hat Build of Keycloak.
Technical ContextAI
Keycloak is an open-source identity and access management solution that handles authentication flows through stateful session handles. The /login-actions/restart endpoint manages authentication session state and, per the advisory, lacks adequate CSRF protection and cookie ownership validation, allowing an unauthenticated party to pre-create an authentication session and bind it to a victim. This is a CWE-290 (Authentication Bypass by Spoofing) class issue rooted in trusting session handles without verifying that the browser cookie and the session identifier belong to the same principal, which is the canonical pattern for session fixation against federated/SSO front-ends.
RemediationAI
No vendor-released patch identified at time of analysis in the provided data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-7507 and Bugzilla entry https://bugzilla.redhat.com/show_bug.cgi?id=2464145 for the fixed Red Hat Build of Keycloak release and apply it as soon as published. Until a patched build is available, compensating controls include restricting administrative console access to trusted networks or VPN-only reachability to keep /login-actions/* off the public internet, enforcing step-up authentication or admin-console-only client policies so that an SSO cookie alone cannot complete privileged required-action flows, and reducing SSO session lifetimes and idle timeouts so victims are less likely to have a live session when clicking a malicious link; each of these reduces convenience for legitimate users (extra logins, VPN dependency) but materially narrows the window for the fixation attack. Operationally, alert on anomalous traffic to /login-actions/restart with externally-supplied session handles and on required-action completions tied to mismatched cookies and source IPs.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstrea
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows an administrator with only limited
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today