Description

A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T06:16:37.437Z",
  "pubdate": "2026-11-06T06:16:37.437Z",
  "executiveSummary": "A critical session fixation vulnerability exists within the OIDC logout endpoint of the keycloak-services component in Red Hat Build of Keycloak.\nThe vulnerability arises from the improper handling of session cookies, where the application sets a session cookie based on an unvalidated token hint provided by a request.\nBy manipulating this token hint, an unauthenticated attacker can pre-set a known session identifier in a victim's browser.\nSuccessful exploitation allows an attacker to perform session hijacking, enabling them to intercept a victim's subsequent authenticated login process.\nThis flaw facilitates complete account takeover, as the attacker effectively controls the established session context once the victim authenticates.\nThe vulnerability represents a significant risk to user integrity and session management security within the affected deployments.\nExploitation does not require prior authentication but necessitates interaction with the victim to plant the malicious session cookie before the user initiates a legitimate login sequence.",
  "technicalDetails": "The vulnerability resides in the OIDC logout endpoint logic within the keycloak-services component. The flaw is fundamentally a session fixation attack vector triggered by the premature processing of an 'id_token_hint' or similar OIDC parameter before comprehensive security validation of the session state is finalized.\nIn the vulnerable implementation, the system attempts to process the logout request and interact with session cookies before verifying the integrity or origin of the provided token hint. By crafting a specific logout request containing a malicious or pre-determined token identifier, an attacker can coerce the keycloak-services component into associating the user's browser session with an attacker-controlled identifier.\nThe attack flow proceeds as follows: First, the attacker initiates a crafted request to the OIDC logout endpoint. The server, failing to validate the request context or the provided token hint, sets a specific session cookie in the attacker's browser—or directs the victim to a URL that forces the victim's browser to store the attacker-selected session ID.\nOnce the victim's browser is associated with this fixed session ID, the attacker waits for the victim to perform a legitimate login. Because the session identifier remains persistent due to the initial fixation, the subsequent authentication process binds the victim's legitimate credentials to the pre-fixed session ID.\nUpon successful authentication by the victim, the server associates the authenticated user profile with the fixed session ID. Since the attacker already knows or controls this session identifier, they can now utilize it to bypass authentication and gain unauthorized access to the victim's account, essentially hijacking the session in real-time.\nThis vulnerability highlights a failure in the OIDC flow state machine, specifically regarding the transition between unauthenticated logout processing and authenticated session establishment. The keycloak-services component lacks proper sanitation of the token hint input, allowing for the injection of values that dictate the server's session management state before it has established a trusted relationship with the user's current intent. Post-exploitation, the attacker maintains full control over the hijacked session, capable of performing any action authorized for the victim's identity until the session is explicitly terminated or expires."
}