Bug 2547298 (CVE-2026-107124)

Summary: CVE-2026-107124 keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, mposolda, pjindal, rmartinc, security-response-team, ssilvert, sthorger, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Deadline: 2026-12-28   

Description OSIDB Bzimport 2026-10-07 07:41:17 UTC 
A Session Fixation vulnerability was discovered in Keycloak's OIDC logout endpoint (/realms/realm/protocol/openid-connect/logout). The endpoint accepts an id_token_hint parameter and writes the browser's AUTH_SESSION_ID cookie derived from the token's session ID (sid) claim before performing full token validation. If validation subsequently fails (such as with a stale token), the endpoint returns a 400 error but fails to expire the newly set cookie.
A secondary design issue allows Keycloak to reuse the root authentication-session ID as the new user-session ID during the next login process. By combining these behaviors, an authenticated attacker in the same realm can plant a chosen AUTH_SESSION_ID in a victim's browser. If the victim then performs a login within the authorization code lifetime window (default 60 seconds) after the attacker revokes their own session, the attacker can redeem a pre-minted authorization code bound to that session ID. This allows the attacker to obtain the victim's tokens and achieve full account takeover of any realm user, including realm administrators.