CVE-2026-7507Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover
Descripción
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| build keycloak | 26.2 | — | |
| build keycloak | 26.4 | — | |
| redhat | build of keycloak | 26.4 – < 26.4.12 | |
| Red Hat | Red Hat build of Keycloak 26.2 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.2.16 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.4 | all versions | |
| Red Hat | Red Hat build of Keycloak 26.4.12 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 7 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 8 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6 for RHEL 9 | all versions | |
| Red Hat | Red Hat Single Sign-On 7.6.13 | — | |
| Red Hat | RHEL-8 based Middleware Containers | all versions | |
| red hat single sign on | 7.6 | — | |
| rhosemc | 1.0 | — |
Referencias y parches
- RHSA-2026:19594 vendor-advisoryVendor Advisory
- RHSA-2026:19595 vendor-advisoryVendor Advisory
- RHSA-2026:19596 vendor-advisoryVendor Advisory
- RHSA-2026:19597 vendor-advisoryVendor Advisory
- RHSA-2026:76128 vendor-advisory
- RHSA-2026:76129 vendor-advisory
- RHSA-2026:76130 vendor-advisory
- RHSA-2026:76132 vendor-advisory
- RHSA-2026:76134 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-7507 vdb-entryVendor Advisory
- RHBZ#2464145 issue-trackingVendor Advisory
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7507.json
Coincidencias CPE (NVD) (1)
cpe:2.3:a:redhat:build_of_keycloak:*:*:*:*:*:*:*:*≥ 26.4 < 26.4.12