Keycloak Session Fixation Flaw Allows Account Takeover (CVE-2026-7507)

The National Vulnerability Database has disclosed CVE-2026-7507, a high-severity session fixation vulnerability in Keycloak’s login-actions endpoints. This flaw, rated 7.5 CVSS (HIGH), allows an unauthenticated attacker to achieve complete account takeover, including highly privileged administrative accounts, without needing the victim’s credentials.

Attackers can pre-create an authentication session and then trick a victim into clicking a specially crafted link. The vulnerability lies in Keycloak’s /login-actions/restart endpoint, which, according to the National Vulnerability Database, inadequately handles session handles without proper CSRF protection or cookie ownership validation. This oversight enables an attacker to reset the authentication flow state, causing the victim’s Single Sign-On (SSO) to authenticate them transparently upon clicking the malicious link. Once authenticated, the attacker can hijack the required-action form, bypassing credential requirements.

This isn’t just a theoretical bypass; it’s a direct path to full compromise. For organizations leveraging Keycloak for identity and access management, especially with SSO, this vulnerability represents a critical risk. The attacker’s calculus here is straightforward: social engineering a click combined with a vulnerable endpoint yields full account control. This underscores the need for robust session management and strict validation at every stage of the authentication flow, particularly in critical components like SSO.