A flaw in the OIDC logout endpoint of the keycloak-services component allows an attacker to set an unvalidated session cookie based on a supplied id_token_hint before the system performs normal security checks. The attacker can fix a session identifier in the victim’s browser and then hijack the victim’s next login session, resulting in full account takeover. The weakness is a session fixation vulnerability (CWE‑384).

The vulnerability affects the Keycloak Services component of Red Hat’s Build of Keycloak. No specific version range is disclosed in the advisory, so any release that has not been reported as patched should be treated as potentially vulnerable.

The CVSS score of 6.4 indicates a moderate severity. No EPSS score is provided, implying that exploitation probability has not been quantified, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, requiring the attacker to deliver a crafted logout request containing a malicious id_token_hint to the target server.