{"id":"CVE-2026-107124","kind":"vulnerability","aliases":["CVE-2026-107124"],"related":[],"title":"Keycloak: OIDC logout endpoint lets attackers fix session IDs and hijack logins","description":"A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.","summary":"The OIDC logout endpoint in Red Hat Build of Keycloak sets a session cookie from an unvalidated token hint before security checks finish. An attacker can fix a session ID in a victim's browser and take over the victim's later login, gaining full account control.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","keycloak","oidc","red-hat-build-of-keycloak","self-hosted"],"not_affected_if":["managed-identity-provider"],"how_to_check":"- Confirm whether you run Red Hat Build of Keycloak or Keycloak with the OIDC logout endpoint exposed (`unknown` for exact version ranges; the sources do not list them)","fix":null,"status":"open","published_at":"2026-11-06T06:16:37+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:41:36+00:00","updated_at":"2026-11-06T06:41:36+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-06T06:41:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: OIDC logout endpoint lets attackers fix session IDs and hijack logins","impact":"high","summary":"The OIDC logout endpoint in Red Hat Build of Keycloak sets a session cookie from an unvalidated token hint before security checks finish. An attacker can fix a session ID in a victim's browser and take over the victim's later login, gaining full account control.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","red-hat-build-of-keycloak","oidc","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker takes over victim account after session fixation","analyst_note":"Find the affected version ranges and fixed versions for Red Hat Build of Keycloak from Red Hat's advisory for CVE-2026-107124.","how_to_check":"- Confirm whether you run Red Hat Build of Keycloak or Keycloak with the OIDC logout endpoint exposed (`unknown` for exact version ranges; the sources do not list them)","plain_action":"","needs_analyst":true,"not_affected_if":["managed-identity-provider"],"who_is_affected":"Organizations running Red Hat Build of Keycloak as an identity provider with the OIDC logout endpoint reachable by users. Deployments that do not use this endpoint or that sit behind managed identity services are less exposed. The sources do not list affected version ranges.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4257,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-107124':15A,18A '-2026':14A,17A 'account':76B,155C 'allow':140C 'attack':6A,55B,125C 'base':114C 'browser':65B,139C 'build':25B,38B,101C 'check':52B,123C 'complet':121C 'compon':92C 'control':77B,152C 'cooki':44B,113C 'cve':13A,16A 'endpoint':4A,34B,86C 'finish':53B 'fix':7A,57B,131C 'flaw':79C,129C 'found':81C 'full':75B,151C 'gain':74B,150C 'handl':94C 'hat':24B,37B,100C 'hijack':11A,143C 'hint':49B,119C 'host':30B 'id':9A,60B,134C 'infrastructur':19B 'issu':105C 'keycloak':1A,20B,27B,40B,90C,103C 'keycloak-servic':89C 'later':72B 'let':5A 'login':12A,73B,148C 'logout':3A,33B,85C 'occur':106C 'oidc':2A,21B,32B,84C 'red':23B,36B,99C 'red-hat-build-of-keycloak':22B 'secur':51B,122C 'self':29B 'self-host':28B 'servic':91C 'session':8A,43B,59B,96C,112C,133C 'set':41B,110C 'subsequ':147C 'system':109C 'take':67B 'termin':97C 'token':48B,118C 'unvalid':47B,117C 'use':127C 'user':95C 'victim':63B,70B,137C,145C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Red Hat Build of Keycloak as an identity provider with the OIDC logout endpoint reachable by users. Deployments that do not use this endpoint or that sit behind managed identity services are less exposed. The sources do not list affected version ranges.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","keycloak","medium","oidc","redhatbuildofkeycloak","selfhosted"],"campaign_type":null,"search_a":"'-107124':15A,18A '-2026':14A,17A 'attack':6A 'cve':13A,16A 'endpoint':4A 'fix':7A 'hijack':11A 'id':9A 'keycloak':1A 'let':5A 'login':12A 'logout':3A 'oidc':2A 'session':8A","search_b":"'account':76B 'attack':55B 'browser':65B 'build':25B,38B 'check':52B 'control':77B 'cooki':44B 'endpoint':34B 'finish':53B 'fix':57B 'full':75B 'gain':74B 'hat':24B,37B 'hint':49B 'host':30B 'id':60B 'infrastructur':19B 'keycloak':20B,27B,40B 'later':72B 'login':73B 'logout':33B 'oidc':21B,32B 'red':23B,36B 'red-hat-build-of-keycloak':22B 'secur':51B 'self':29B 'self-host':28B 'session':43B,59B 'set':41B 'take':67B 'token':48B 'unvalid':47B 'victim':63B,70B","search_c":"'account':155C 'allow':140C 'attack':125C 'base':114C 'browser':139C 'build':101C 'check':123C 'complet':121C 'compon':92C 'control':152C 'cooki':113C 'endpoint':86C 'fix':131C 'flaw':79C,129C 'found':81C 'full':151C 'gain':150C 'handl':94C 'hat':100C 'hijack':143C 'hint':119C 'id':134C 'issu':105C 'keycloak':90C,103C 'keycloak-servic':89C 'login':148C 'logout':85C 'occur':106C 'oidc':84C 'red':99C 'secur':122C 'servic':91C 'session':96C,112C,133C 'set':110C 'subsequ':147C 'system':109C 'termin':97C 'token':118C 'unvalid':117C 'use':127C 'user':95C 'victim':137C,145C","first_public_at":"2026-11-06T06:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107124","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107124","severity":null,"published_at":"2026-11-06T06:16:37+00:00","modified_at":"2026-11-06T06:16:38+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}