A session fixation vulnerability in Keycloak's login-actions endpoints
allows an unauthenticated attacker to pre-create an authentication
session, deliver a crafted link to a victim, and claim the resulting
required-action form without the victim entering any credentials.
A separate endpoint, /login-actions/restart, accepts the session
handle with no CSRF token or cookie ownership check, enabling the
attacker to reset flow state so that SSO fires silently when the
victim clicks the link. The demonstrated impact
on the default Keycloak deployment is full takeover of the
master-realm admin account.