PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-7507 Red Hat CVE debrief

CVE-2026-7507 is a high-severity session fixation vulnerability affecting Keycloak login-actions endpoints. According to the supplied description, an unauthenticated attacker can pre-create an authentication session and lure a victim into a crafted link. By abusing the /login-actions/restart endpoint, the attacker can reset authentication flow state without proper CSRF protection or cookie ownership validation, potentially causing the victim to authenticate into the attacker-controlled session. The result can be hijacking of the required-action flow and, in the worst case, account takeover. NVD lists the record as undergoing analysis, and the provided references point to Red Hat advisories and a Red Hat Bugzilla entry.

Vendor
Red Hat
Product
Red Hat build of Keycloak 26.2
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-19
Original CVE updated
2026-05-20
Advisory published
2026-05-19
Advisory updated
2026-05-20

Who should care

Identity and SSO administrators, Keycloak operators, teams running Red Hat-managed Keycloak deployments, and security responders responsible for login or required-action flows should prioritize this issue. Any environment that relies on browser-based SSO enrollment or post-login required actions should review whether it is exposed.

Technical summary

The issue is described as a session fixation flaw in Keycloak's login-actions endpoints. The attack path relies on the /login-actions/restart endpoint accepting session handles without sufficient CSRF protection or validation that the handle belongs to the current browser/session context. That weakness can let an attacker influence the victim's authentication flow after the victim clicks a malicious link. The supplied NVD record maps the weakness to CWE-290 and provides a CVSS v3.1 vector of AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, which reflects a network-reachable issue that requires user interaction and can have severe confidentiality, integrity, and availability impact.

Defensive priority

High. The combination of unauthenticated reachability, user interaction, and potential account takeover makes this a priority for identity platforms even though exploitation requires social engineering. Treat it as urgent for externally reachable SSO portals and any deployment where required actions or login restarts are used.

Recommended defensive actions

  • Review the Red Hat security advisory links in the references for affected product versions and fixed builds.
  • Check whether any Keycloak or Keycloak-based SSO deployment uses the login-actions restart flow exposed to users.
  • Apply vendor patches or errata as soon as they are available for your environment.
  • Audit authentication logs for unusual restart-flow activity, repeated login-actions requests, or suspicious session transitions.
  • Harden SSO entry points with phishing-resistant controls and user-awareness measures to reduce link-based abuse.
  • Validate that CSRF protections and session binding controls are functioning as expected in custom integrations or reverse-proxy configurations.
  • If you operate Red Hat-supported products, track the linked RHSA advisories and associated Bugzilla report for remediation status.

Evidence notes

All claims in this debrief are grounded in the supplied CVE description and the official metadata in the NVD record. The record shows publishedAt 2026-05-19T12:16:19.687Z and modifiedAt 2026-05-20T17:16:28.883Z, with NVD vulnStatus marked 'Undergoing Analysis.' The record's references point to Red Hat errata, a Red Hat CVE page, and Red Hat Bugzilla, which is the strongest available corroboration in the provided corpus. Vendor identity is not fully resolved in the supplied metadata, so references to Keycloak and Red Hat should be treated as source-backed context rather than a finalized vendor assignment.

Official resources

CVE published by NVD on 2026-05-19 and last modified on 2026-05-20. The supplied NVD record is marked 'Undergoing Analysis,' and the linked Red Hat references indicate active vendor tracking.