A session fixation vulnerability in the Red Hat build of Keycloak login-actions endpoints poses a high risk of unauthorized account access.

This is a session fixation flaw (CWE-290) where the application fails to properly regenerate session identifiers during the authentication process, allowing an attacker to spoof or hijack established sessions.

An attacker capable of exploiting this flaw can gain unauthorized access to user sessions, leading to potential account takeovers and data theft. With a CVSS score of 7.5, the vulnerability represents a significant threat to identity management infrastructure and organizational security.

Immediate Action: Apply the vendor-provided security updates (RHSA-2026:19594 through RHSA-2026:19597) to move to the fixed versions (e.g., 26.2.16-1 or 26.4.12-1).

Proactive Monitoring: Monitor authentication logs for anomalous session activity or repeated login attempts targeting the login-actions endpoint.

Compensating Controls: Ensure that session timeouts are strictly enforced and consider implementing additional multi-factor authentication (MFA) requirements for all user logins.

Public Exploit Available: No confirmed public exploit available.

Organizations utilizing the Red Hat build of Keycloak should prioritize patching to the versions specified in the Red Hat errata. Failure to remediate could allow attackers to bypass standard authentication controls.