Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat build of Keycloak 26.2
Vendor
Red Hat
Product
Red Hat build of Keycloak 26.2
Platforms
Unknown
Default status
affected
Package
rhbk/keycloak-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
26.2.16-1
unaffected
rpm
*
Unavailable
None listed
Red Hat build of Keycloak 26.2
Vendor
Red Hat
Product
Red Hat build of Keycloak 26.2
Platforms
Unknown
Default status
affected
Package
rhbk/keycloak-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat build of Keycloak 26.2 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
26.2-21
unaffected
rpm
*
Unavailable
None listed
Red Hat build of Keycloak 26.2
Vendor
Red Hat
Product
Red Hat build of Keycloak 26.2
Platforms
Unknown
Default status
affected
Package
rhbk/keycloak-rhel9-operator
Package collection
https://catalog.redhat.com/software/containers/
Red Hat build of Keycloak 26.2 · Scoped product and version facts