Sign in
Deutsch English Español Polski
High

Keycloak: Session fixation in OIDC login flow that can lead to account takeover

  • Disclosed: 19.05.2026
  • Updated: 11.10.2026 12:22

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Java / Kotlin (Maven) org.keycloak:keycloak-services < 26.6.2 26.6.2

References

CVSS score 7.5/10
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-290
Platform
Java / Kotlin (Maven)
Package
org.keycloak:keycloak-services
Disclosed
19.05.2026
Updated
11.10.2026 12:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-hf67-5vvq-fm3r - CC BY 4.0

Vulnerability history: org.keycloak:keycloak-services

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (98) in the archive
Total entries
98
First → latest
01.2022 08.2026
Without a fix
16
Exploited in attacks
0

Severity breakdown

  • Critical 3
  • High 26
  • Medium 51
  • Low 18

Disclosures per year

Severity:
  1. Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
    Critical · 9.1 CVE-2026-18963 >= 26.0.0, < 26.4.15, >= 26.5.0, < 26.6.6, >= 26.7.0, < 26.7.2 26.4.15, 26.6.6, 26.7.2
  2. Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
    High · 7.7 CVE-2026-2092 <= 26.2.5, >= 26.3.0, <= 26.4.7, >= 26.5.0 no fix
  3. Keycloak has privilege escalation via improper scope mapping enforcement
    High · 7.3 CVE-2026-9795 < 26.6.4 26.6.4
  4. Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
    High · 8.1 CVE-2026-7504 < 26.6.2 26.6.2
  5. Keycloak: Session fixation in OIDC login flow that can lead to account takeover this entry
    High · 7.5 CVE-2026-7507 < 26.6.2 26.6.2
  6. Keycloak: Access token disclosure and implicit flow bypass via forged client data
    High · 7.1 CVE-2026-7571 < 26.6.2 26.6.2
  7. Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
    High · 7.4 CVE-2026-4282 < 26.5.7 26.5.7
  8. Keycloak: Application-Level DoS via Scope Processing
    High · 7.5 CVE-2026-4634 < 26.5.7 26.5.7
  9. Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
    High · 8.1 CVE-2026-4636 < 26.5.7 26.5.7
  10. Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
    High · 7.3 CVE-2026-3872 < 26.5.7 26.5.7
  11. Keycloak: Unauthorized authentication via disabled SAML Identity Provider
    High · 8.1 CVE-2026-2603 < 26.5.5 26.5.5
  12. Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
    High · 8.1 CVE-2026-3009 < 26.5.5 26.5.5
  13. Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
    High · 8.8 CVE-2026-1486 >= 26.5.0, < 26.5.3, < 26.4.9 26.5.3, 26.4.9
  14. Keycloak affected by improper invitation token validation
    High · 8.1 CVE-2026-1529 >= 26.5.0, < 26.5.3, < 26.2.13, >= 26.3.0, < 26.4.9 26.5.3, 26.2.13, 26.4.9
  15. Keycloak hostname verification
    High · 8.2 CVE-2025-3501 < 26.2.2 26.2.2
  16. org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
    High · 6.5 CVE-2024-10270 < 24.0.9, >= 25.0.0, < 26.0.6 24.0.9, 26.0.6
  17. Keycloak has session fixation in Elytron SAML adapters
    High · 7.1 CVE-2024-7341 < 22.0.12, >= 23.0.0, < 24.0.7, >= 25.0.0, < 25.0.5 22.0.12, 24.0.7, 25.0.5
  18. Keycloak's admin API allows low privilege users to use administrative functions
    High · 8.1 CVE-2024-3656 < 24.0.5 24.0.5
  19. Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
    High · 7.5 CVE-2024-4540 < 24.0.5 24.0.5
  20. Keycloak path traversal vulnerability in redirection validation
    High · 8.1 CVE-2024-1132 < 22.0.10, >= 23.0.0, < 24.0.3 22.0.10, 24.0.3
Show more (9) Showing 20 of 29

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.