A session fixation flaw was discovered in the login‑actions endpoints of Keycloak. The vulnerability allows an unauthenticated attacker to pre‑create an authentication session and trick a user into following a malicious link that calls the /login-actions/restart endpoint. Because this endpoint does not enforce proper CSRF checks or verify cookie ownership, it resets the state of the authentication flow and forces the target’s single sign‑on process to authenticate transparently when the link is clicked. The attacker can then hijack the required‑action form without ever needing the victim’s credentials. If successfully exploited, the attacker can gain full access to the victim’s account, including high‑privilege administrative accounts, resulting in loss of confidentiality, integrity and availability for the affected user.

The affected vendor is Red Hat: Red Hat Build of Keycloak. No specific release or version information is provided in the advisory, so all Red Hat‑provided Keycloak deployments that contain the vulnerable login‑actions endpoints are potentially impacted.

The flaw carries a CVSS score of 7.5, indicating a high‑risk severity. EPSS data is not available, so the likelihood of exploitation cannot be quantified, though the absence of an existing KEV listing suggests no known widespread exploitation to date. The attack vector appears to be through the web authentication flow, requiring only a malicious link sent to a victim and no pre‑existing credentials. The resulting account takeover represents a critical breach, especially if privileged accounts are taken over.