CVE-2026-107124 · Infrastructure
NO FIX YET
The OIDC logout endpoint in Red Hat Build of Keycloak sets a session cookie from an unvalidated token hint before security checks finish. An attacker can fix a session ID in a victim's browser and take over the victim's later login, gaining full account control.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organizations running Red Hat Build of Keycloak as an identity provider with the OIDC logout endpoint reachable by users. Deployments that do not use this endpoint or that sit behind managed identity services are less exposed. The sources do not list affected version ranges.
Not affected if managed-identity-provider
Who cares keycloak, oidc, red-hat-build-of-keycloak, self-hosted
unknown for exact version ranges; the sources do not list them)No fix yet, per the sources.
A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.