Description

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-11-06T06:16:45.377Z",
  "pubdate": "2026-11-06T06:16:45.377Z",
  "executiveSummary": "A critical session management vulnerability exists within the Keycloak Account REST API, classified as an insecure direct object reference or session manipulation flaw.\nThe vulnerability allows an authenticated attacker to manipulate session identification parameters, effectively hijacking another user's active session.\nBy coercing the application to associate the attacker's authentication context with a victim's session, the attacker gains unauthorized access to the victim's account data.\nImpact includes full account takeover, as the attacker can modify account-level security configurations, such as updating recovery email addresses and performing password reset operations.\nThis represents a high-severity risk to identity management integrity, as it bypasses standard authorization boundaries and session isolation mechanisms.\nThe attack is executable by any authenticated client owner, requiring no elevated administrative privileges to initiate the session manipulation vector.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper validation and binding of session identifiers within the Keycloak Account REST API processing layer. Specifically, the API fails to strictly enforce the association between an authenticated user's security token and the session context provided in the request body or parameters.\nThe exploitation flow begins when an attacker, possessing a valid account on the Keycloak instance, initiates a request to the Account REST API. Instead of operating within their own session context, the attacker modifies session identification fields within the request payload to point to a target victim's active session identifier.\nDue to a failure in the backend to cross-reference the session token’s identity claims against the requested session ID during these API interactions, the system improperly authorizes the request. This lack of server-side state validation allows the attacker to bypass access controls intended to scope API operations strictly to the owner of the security token.\nOnce the session mapping is successfully manipulated, the attacker performs privileged operations on behalf of the victim. Because the API processes these requests under the assumed context of the victim's session, it treats the attacker's commands as legitimate actions performed by the account holder.\nThe post-exploitation phase involves the attacker leveraging the API to execute sensitive account modifications. By changing the recovery email address to one controlled by the attacker, the integrity of the account's security recovery flow is compromised. Subsequently, the attacker can trigger a password reset via the updated recovery email, achieving full account takeover.\nThis vulnerability highlights a critical failure in the verification of identity assertions when managing multi-tenant or multi-user session state within the Keycloak API gateway. The flaw exists in the component responsible for parsing and associating session identifiers with incoming REST API traffic. Exposure is limited to the internal and external network interfaces exposed by the Keycloak service, as the attacker must be capable of establishing an authenticated session to perform the initial manipulation."
}