Keycloak on Red Hat /login-actions/restart authentication spoofing

Summaryinfo

A vulnerability has been found in Keycloak on Red Hat and classified as critical. Impacted is an unknown function of the file /login-actions/restart. This manipulation causes authentication spoofing. This vulnerability appears as CVE-2026-7507. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Keycloak on Red Hat (the affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown part of the file /login-actions/restart. The manipulation with an unknown input leads to a authentication spoofing vulnerability. The CWE definition for the vulnerability is CWE-290. This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which processes session handles without adequate CSRF protection or cookie ownership validation—an attacker can reset the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently upon clicking the link, allowing the attacker to hijack the required-action form without needing the victim's credentials. A successful exploit could lead to complete account takeover, including highly privileged administrative accounts.

The advisory is shared at access.redhat.com. This vulnerability is known as CVE-2026-7507 since 04/30/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/22/2026).

The vulnerability scanner Nessus provides a plugin with the ID 316461 (Keycloak < 26.6.2 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (316461) and CERT Bund (WID-SEC-2026-1612). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Red Hat Enterprise Linux
• Open Source Keycloak

Productinfo

Name

• Keycloak

License

• open-source

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion