CVE-2026-97367
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification.
Impact
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
An attacker can exploit this over the network, with a regular user account, but a user has to do something, such as open a file or a link. Specific conditions have to be met, which makes an attack harder. If it succeeds: high risk of data being read, high risk of data or systems being changed.
Affected products · Red Hat
| Product | Affected versions |
|---|---|
| Red Hat build of Keycloak 26.4 | Versions patch: 26.4-30, patch: 26.4-29, patch: 26.4.17-2 |
| Red Hat build of Keycloak 26.6 | Versions patch: 26.6.8-2, patch: 26.6-24 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2026:95759
- https://access.redhat.com/errata/RHSA-2026:95760
- https://access.redhat.com/errata/RHSA-2026:95761
- https://access.redhat.com/errata/RHSA-2026:95762
- https://access.redhat.com/security/cve/CVE-2026-97367
- https://bugzilla.redhat.com/show_bug.cgi?id=2540080