Introduction
A session fixation flaw in Keycloak's authentication flow lets an unauthenticated attacker silently hijack a victim's single sign-on (SSO) session and take over their account, including the master realm administrator. Red Hat has confirmed that on a default Keycloak deployment, the demonstrated impact is full takeover of the most privileged account in the system.
Keycloak is a widely adopted open-source identity and access management platform. Organizations use it to provide SSO, user federation, and fine-grained authorization for applications and services. Red Hat provides enterprise support through the Red Hat Build of Keycloak (formerly Red Hat Single Sign On), and many enterprise security architectures are built on it.
Technical Information
CVE-2026-7507 is classified under CWE-290 (Authentication Bypass by Spoofing) and carries a CVSS 3.1 base score of 7.5 with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is in Keycloak's /login-actions/restart endpoint, one of the login-actions endpoints that manage authentication session state.
Root Cause
The /login-actions/restart endpoint accepts and processes authentication session handles without two security checks:
- It does not validate a CSRF token to verify that the request came from a legitimate user action within the expected authentication flow.
- It does not confirm that the session handle being processed belongs to the browser (and therefore the user) making the request.
With neither check in place, Keycloak trusts an externally supplied session handle at face value. An attacker can use this to inject a pre-created session of their own into a victim's browser context.
Attack Flow
The attack runs in six steps:
-
The attacker, who is unauthenticated, starts an authentication session against the target Keycloak instance. This produces a session handle the attacker controls.
-
The attacker builds a malicious URL pointing to the
/login-actions/restartendpoint, with the pre-created session handle embedded as a parameter. -
The attacker sends the link to the victim through any social-engineering channel (email, chat, embedded in a page), and the victim clicks it.
-
When the victim's browser hits the
/login-actions/restartendpoint, Keycloak resets the authentication flow state using the attacker-controlled session handle. With no CSRF check and no cookie ownership check, Keycloak accepts the reset without question. -
If the victim already has an active SSO session with the Keycloak instance (common in enterprise environments where users stay logged in), the reset makes SSO fire transparently. The victim is authenticated into the attacker-controlled session without being prompted for credentials.
-
The attacker can now claim the resulting required-action form. Because the attacker pre-created the session, they keep access to its context and can complete any required actions (such as password resets or account configuration) on behalf of the now-authenticated victim.
CVSS Vector Breakdown
| Component | Value | Meaning |
|---|---|---|
| Attack Vector | Network (AV:N) | Exploitable remotely over the network |
| Attack Complexity | High (AC:H) | Requires specific conditions (victim must have active SSO session) |
| Privileges Required | None (PR:N) | Attacker needs no prior authentication |
| User Interaction | Required (UI:R) | Victim must click the crafted link |
| Confidentiality Impact | High (C:H) | Full access to victim account data |
| Integrity Impact | High (I:H) | Attacker can modify account settings and data |
| Availability Impact | High (A:H) | Attacker can lock out the legitimate user |
Community Context
Community discussions had already raised concerns about how fragile Keycloak's session handling is in the restart flow. GitHub Issue 43896 documents a RESTART_AUTHENTICATION_ERROR during registration flows with email verification, where the /login-actions/restart endpoint disrupts the authentication session context. Separately, GitHub Discussion 37070 raised the concern that Keycloak does not generate new AUTH_SESSION_ID values after successful authentication, which points to broader session fixation risks in the authentication process.
Affected Package
Red Hat identifies the affected package as rhbk/keycloak-rhel9-operator, part of the Red Hat Build of Keycloak distribution. The Bugzilla entry title indicates that the vulnerable code is in the upstream org.keycloak/keycloak-services module.
Affected Systems and Versions
Red Hat lists the following as affected:
| Product | Package |
|---|---|
| Red Hat Build of Keycloak | rhbk/keycloak-rhel9-operator |
The available advisories do not give specific affected version ranges. The vulnerability originates in the upstream Keycloak project (org.keycloak/keycloak-services). Organizations running any version of Keycloak or the Red Hat Build of Keycloak should treat it as potentially applicable until Red Hat publishes fixed version numbers.
Vendor Security History
Keycloak has had several notable security issues disclosed in 2026, which reflects how complex identity and access management software is:
| Advisory | Description |
|---|---|
| GHSA-h4wv-g838-66g3 | Application-level Denial of Service via scope processing. An unauthenticated attacker could send a crafted POST request to cause DoS |
| GHSA-hj93-h7pg-fh6v | Privilege escalation via forged authorization codes due to lack of namespace isolation in SingleUseObjectProvider |
| GHSA-f2hx-5fx3-hmcv | UMA policy resource injection allowing an attacker to gain unauthorized permissions and obtain a Requesting Party Token |
| CVE-2026-2575 | Denial of Service via highly compressed SAMLRequest sent by an unauthenticated remote attacker |
The record shows that the Keycloak maintainers actively identify and disclose vulnerabilities, and also that the product's authentication and authorization surface keeps yielding complex flaws.
References
- Red Hat CVE Page for CVE-2026-7507
- Red Hat Bugzilla: 2464145
- NVD Entry for CVE-2026-7507
- Red Hat CVE JSON Data
- Keycloak GitHub Issue 43896: RESTART_AUTHENTICATION_ERROR
- Keycloak GitHub Discussion 37070: Session Fixation in Authentication Process
- GHSA-h4wv-g838-66g3: Application Level DoS via Scope Processing
- GHSA-hj93-h7pg-fh6v: Privilege Escalation via Forged Authorization Codes
- GHSA-f2hx-5fx3-hmcv: UMA Policy Resource Injection
- Red Hat Single Sign On Extended Lifecycle Support
