CVE-2026-7507: Keycloak Auth Bypass Vulnerability

CVE-2026-7507 Overview

CVE-2026-7507 is a session fixation vulnerability [CWE-290] in Keycloak's login-actions endpoints. An unauthenticated attacker pre-creates an authentication session and lures a victim into clicking a crafted link. The /login-actions/restart endpoint processes session handles without adequate Cross-Site Request Forgery (CSRF) protection or cookie ownership validation. This design flaw lets the attacker reset the authentication flow state and bind the victim's Single Sign-On (SSO) authentication to the attacker-controlled session. The result is hijacking of the required-action form and full account takeover, including administrative accounts.

Critical Impact

Successful exploitation enables complete account takeover of Keycloak users, including highly privileged administrators, without requiring the victim's credentials.

Affected Products

• Red Hat Build of Keycloak (see RHSA-2026:19594)
• Red Hat Single Sign-On / Keycloak distributions (see RHSA-2026:19595, RHSA-2026:19596)
• Red Hat Keycloak container images (see RHSA-2026:19597)

Discovery Timeline

• 2026-05-19 - CVE-2026-7507 published to NVD
• 2026-05-20 - Last updated in NVD database

Technical Details for CVE-2026-7507

Vulnerability Analysis

The vulnerability resides in Keycloak's authentication flow handling at the /login-actions/restart endpoint. This endpoint accepts a session handle and resets the authentication flow state without validating that the requester owns the underlying cookie or supplying a valid anti-CSRF token. An attacker first initiates a legitimate authentication session against the Keycloak server and captures the corresponding session identifier. The attacker then embeds that identifier into a crafted URL pointing at /login-actions/restart and delivers it to a target user. When the victim follows the link while holding a valid SSO session, Keycloak silently authenticates the victim into the attacker-pre-created flow. The attacker, holding the original session handle, can then advance the flow through any pending required-action forms.

Root Cause

The root cause is improper authentication binding [CWE-290]. Keycloak treats the inbound session handle as authoritative without verifying that the browser presenting the request owns the associated authentication session cookie. The endpoint also omits CSRF token enforcement, so cross-origin invocations succeed. These two omissions allow an attacker's session state to be merged with the victim's authenticated browser context.

Attack Vector

Exploitation requires network access to the Keycloak realm and user interaction. The attack chain proceeds in four stages. First, the attacker calls Keycloak to instantiate an authentication session and records the session handle. Second, the attacker constructs a URL targeting /login-actions/restart containing that handle. Third, the attacker delivers the link through phishing, chat, or a malicious page. Fourth, the victim's existing SSO cookie causes transparent authentication into the attacker-controlled flow, after which the attacker submits required-action forms to complete takeover. High attack complexity reflects the timing and pre-staging required, but no credentials are needed from the victim.

No public proof-of-concept code is available. Refer to the Red Hat CVE Analysis CVE-2026-7507 and Red Hat Bug Report #2464145 for vendor technical details.

Detection Methods for CVE-2026-7507

Indicators of Compromise

• Repeated requests to /login-actions/restart from IP addresses that did not previously initiate an /auth request for the same session handle.
• Authentication events where the Referer or Origin header does not match the Keycloak realm's expected client origins.
• Required-action completions (password reset, OTP enrollment, consent) executed from a different IP or User-Agent than the preceding login.
• Sudden privilege changes or new credential enrollment on administrative Keycloak accounts following an external link click.

Detection Strategies

• Correlate Keycloak event logs to flag mismatches between the IP that created an authentication session and the IP that completed restart or required-action steps.
• Alert on /login-actions/restart requests lacking a same-site Referer header or arriving cross-origin.
• Monitor for high-frequency creation of authentication sessions from single IPs that never complete authentication, indicating session pre-staging.

Monitoring Recommendations

• Forward Keycloak EVENT and ADMIN_EVENT streams to a SIEM and retain session-handle, client-IP, and user-agent fields.
• Track authentication flow restart frequency per realm and baseline normal rates to detect anomalies.
• Audit administrative account logins for unexpected required-action prompts or session resumes.

How to Mitigate CVE-2026-7507

Immediate Actions Required

• Apply the Red Hat updates referenced in RHSA-2026:19594, RHSA-2026:19595, RHSA-2026:19596, and RHSA-2026:19597 to all Keycloak and Red Hat build of Keycloak instances.
• Invalidate all active authentication sessions after patching to evict any attacker-pre-staged handles.
• Force re-authentication for privileged and administrative accounts and rotate their credentials.
• Review Keycloak event logs for the last 90 days for the indicators listed above.

Patch Information

Red Hat has released fixes through the following advisories: RHSA-2026:19594, RHSA-2026:19595, RHSA-2026:19596, and RHSA-2026:19597. The patched builds enforce cookie ownership validation and CSRF protection on the /login-actions/restart endpoint. Consult the Red Hat CVE Analysis CVE-2026-7507 for the specific package versions for each Keycloak distribution.

Workarounds

• Place Keycloak behind a reverse proxy that strips or validates cross-origin requests to /login-actions/* paths.
• Configure a Web Application Firewall (WAF) rule to block requests to /login-actions/restart that lack a same-origin Referer header.
• Reduce SSO session lifetimes and required-action token lifespans in realm settings to shorten the exploitation window.
• Require step-up authentication for administrative actions so a hijacked session cannot complete privileged operations without additional verification.

# Example NGINX rule blocking cross-origin requests to login-actions/restart
location ~* ^/realms/.+/login-actions/restart {
    if ($http_referer !~* "^https://keycloak\.example\.com/") {
        return 403;
    }
    proxy_pass http://keycloak_backend;
}