The vulnerability lies in Keycloak’s Account REST API where session identification is mismanaged. A malicious client owner can modify their own security tokens to reference another user’s active session, granting unauthorized access to the victim’s account data. This flaw can lead to complete account takeover, allowing the attacker to alter recovery email addresses and reset passwords.

Keycloak services, particularly the Account REST API. No specific version information is given, so all installations of Keycloak that use this API are potentially affected.

The CVSS score of 6.4 indicates a medium severity level. The EPSS score is not available, but the flaw’s presence in a widely used identity platform and its ability to hijack active sessions make it a notable risk. Although the vulnerability is not listed in the CISA KEV catalog, the likely attack vector involves an authenticated client with owner privileges manipulating azp and sid claims to redirect session context. Attackers with these capabilities can readily conduct exploitation without needing additional footholds.