CVE-2026-7507 Details

A session fixation vulnerability exists in Keycloak's login-actions endpoints. An unauthenticated attacker can exploit this issue by pre-creating an authentication session and tricking a victim into clicking a malicious link. The attacker can use the /login-actions/restart endpoint, which lacks proper Cross-Site Request Forgery (CSRF) protection and cookie ownership validation, to reset the authentication flow. This manipulation causes Single Sign-On (SSO) to authenticate the victim automatically when they click the link, enabling the attacker to hijack the required-action form without needing the victim's credentials. Successful exploitation could result in complete account takeover, including access to highly privileged administrative accounts.