CVE-2026-7507
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.
Risk Assessment
The risk for the organization includes the possibility of complete account takeover, especially for highly privileged accounts, potentially leading to unauthorized access to sensitive data and systems.
Recommendation
It is recommended to immediately update Keycloak to a patched version and implement CSRF protection and cookie ownership validation for login endpoints.
Original NVD description (English source)
A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.