A Session Fixation vulnerability was discovered in Keycloak's OIDC logout endpoint (/realms/realm/protocol/openid-connect/logout). The endpoint accepts an id_token_hint parameter and writes the browser's AUTH_SESSION_ID cookie derived from the token's session ID (sid) claim before performing full token validation. If validation subsequently fails (such as with a stale token), the endpoint returns a 400 error but fails to expire the newly set cookie.
A secondary design issue allows Keycloak to reuse the root authentication-session ID as the new user-session ID during the next login process. By combining these behaviors, an authenticated attacker in the same realm can plant a chosen AUTH_SESSION_ID in a victim's browser. If the victim then performs a login within the authorization code lifetime window (default 60 seconds) after the attacker revokes their own session, the attacker can redeem a pre-minted authorization code bound to that session ID. This allows the attacker to obtain the victim's tokens and achieve full account takeover of any realm user, including realm administrators.