Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-05T00:00:00 keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N CWE-287

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires the attacker to possess client registration privileges and relies on specific session timing and user interaction. Successful exploitation allows an attacker to read and modify victim account data, potentially leading to full account takeover. The vulnerability's root cause is the lack of validation between the token subject and the resolved session user, combined with the ability to map sensitive claims like sid via DCR. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat build of Keycloak 26.4 2026-11-06T00:00:00Z RHSA-2026:95760 rhbk/keycloak-operator-bundle:26.4.17-2 Red Hat build of Keycloak 26.4 2026-11-06T00:00:00Z RHSA-2026:95760 rhbk/keycloak-rhel9:26.4-29 Red Hat build of Keycloak 26.4 2026-11-06T00:00:00Z RHSA-2026:95760 rhbk/keycloak-rhel9-operator:26.4-30 Red Hat build of Keycloak 26.4.17 2026-11-06T00:00:00Z RHSA-2026:95759 keycloak-services Red Hat build of Keycloak 26.4.17 2026-11-06T00:00:00Z RHSA-2026:95759 rhbk/keycloak-rhel9 Red Hat build of Keycloak 26.6 2026-11-06T00:00:00Z RHSA-2026:95762 rhbk/keycloak-operator-bundle:26.6.8-2 Red Hat build of Keycloak 26.6 2026-11-06T00:00:00Z RHSA-2026:95762 rhbk/keycloak-rhel9:26.6-24 Red Hat build of Keycloak 26.6 2026-11-06T00:00:00Z RHSA-2026:95762 rhbk/keycloak-rhel9-operator:26.6-24 Red Hat build of Keycloak 26.6.8 2026-11-06T00:00:00Z RHSA-2026:95761 keycloak-services Red Hat build of Keycloak 26.6.8 2026-11-06T00:00:00Z RHSA-2026:95761 rhbk/keycloak-rhel9 Red Hat Single Sign-On 7 Not affected keycloak-services https://www.cve.org/CVERecord?id=CVE-2026-97367 https://nvd.nist.gov/vuln/detail/CVE-2026-97367