CVE-2026-97367 · Infrastructure
NO FIX YET
The Keycloak Account REST API mishandles session identification, so a malicious client owner can alter their own tokens to point at another user's active session. An attacker can then read and change the victim's account details, such as the recovery email, and reset the password for a full account takeover.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Organisations running Keycloak as their identity provider where third parties or untrusted users can own clients. The risk depends on a client owner acting against other users, so single-tenant deployments with only trusted clients are lower risk. unknown for exact affected versions.
Not affected if single-tenant-trusted-clients
Who cares identity, keycloak, self-hosted
No fix yet, per the sources.
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.