Flaw in Keycloak Account REST API Allows Unauthorized Access to User Sessions
CVE-2026-97367

6.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Build Of Keycloak
Red Hat Single Sign-on 7
Vendor
CVE Published:
6 November 2026

What is CVE-2026-97367?

A vulnerability exists in the Keycloak Account REST API due to improper handling of session identification. This flaw enables an attacker who owns a client to manipulate their security tokens, redirecting them to a different user's active session. Consequently, the attacker can gain unauthorized access to the victim's account, allowing them to modify sensitive information, such as changing recovery emails and resetting passwords, resulting in potential account compromise.

References

https://access.redhat.com/security/cve/CVE-2026-97367
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2540080
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.