{"id":"CVE-2026-97367","kind":"vulnerability","aliases":["CVE-2026-97367"],"related":[],"title":"Keycloak: Account REST API lets a client owner reach other users' sessions","description":"A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.","summary":"The Keycloak Account REST API mishandles session identification, so a malicious client owner can alter their own tokens to point at another user's active session. An attacker can then read and change the victim's account details, such as the recovery email, and reset the password for a full account takeover.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","infrastructure","keycloak","self-hosted"],"not_affected_if":["single-tenant-trusted-clients"],"how_to_check":"- Check the Keycloak version in use against the affected ranges (unknown from the sources)\n- Confirm whether the Account REST API is exposed to clients you do not fully control\n- Review which clients are registered and who owns them","fix":null,"status":"open","published_at":"2026-11-06T06:16:45+00:00","first_seen_at":"2026-11-06T06:40:13+00:00","triaged_at":"2026-11-06T06:41:36+00:00","updated_at":"2026-11-06T06:41:36+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-06T06:41:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Keycloak: Account REST API lets a client owner reach other users' sessions","impact":"high","summary":"The Keycloak Account REST API mishandles session identification, so a malicious client owner can alter their own tokens to point at another user's active session. An attacker can then read and change the victim's account details, such as the recovery email, and reset the password for a full account takeover.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","identity"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker takes over another user's account and password","analyst_note":"Check the NVD entry and Keycloak project advisories for affected and fixed versions and whether the Account REST API is enabled by default.","how_to_check":"- Check the Keycloak version in use against the affected ranges (unknown from the sources)\n- Confirm whether the Account REST API is exposed to clients you do not fully control\n- Review which clients are registered and who owns them","plain_action":"","needs_analyst":true,"not_affected_if":["single-tenant-trusted-clients"],"who_is_affected":"Organisations running Keycloak as their identity provider where third parties or untrusted users can own clients. The risk depends on a client owner acting against other users, so single-tenant deployments with only trusted clients are lower risk. unknown for exact affected versions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4223,"output_tokens":531,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-97367':15A,18A 'access':117C 'account':2A,27B,61B,75B,84C,123C,130C 'activ':49B,110C 'allow':113C 'alter':39B 'anoth':46B 'api':4A,29B,86C 'attack':52B,115C 'chang':57B,133C 'client':7A,36B,95C 'cve':13A,16A 'detail':62B 'differ':107C 'email':67B,136C 'flaw':78C 'found':80C 'full':74B,129C 'handl':90C 'host':24B 'ident':19B 'identif':32B,92C 'incorrect':89C 'inform':124C 'infrastructur':20B 'keycloak':1A,21B,26B,83C 'lead':126C 'let':5A 'malici':35B,94C 'manipul':98C 'mishandl':30B 'modifi':119C 'owner':8A,37B,96C 'password':71B,140C 'point':44B,104C 'potenti':125C 'reach':9A 'read':55B 'recoveri':66B,135C 'reset':69B,138C 'rest':3A,28B,85C 'secur':101C 'self':23B 'self-host':22B 'session':12A,31B,50B,91C,111C 'takeov':76B,131C 'token':42B,102C 'user':11A,47B,108C 'victim':59B,121C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Keycloak as their identity provider where third parties or untrusted users can own clients. The risk depends on a client owner acting against other users, so single-tenant deployments with only trusted clients are lower risk. unknown for exact affected versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["identity","infrastructure","keycloak","medium","selfhosted"],"campaign_type":null,"search_a":"'-2026':14A,17A '-97367':15A,18A 'account':2A 'api':4A 'client':7A 'cve':13A,16A 'keycloak':1A 'let':5A 'owner':8A 'reach':9A 'rest':3A 'session':12A 'user':11A","search_b":"'account':27B,61B,75B 'activ':49B 'alter':39B 'anoth':46B 'api':29B 'attack':52B 'chang':57B 'client':36B 'detail':62B 'email':67B 'full':74B 'host':24B 'ident':19B 'identif':32B 'infrastructur':20B 'keycloak':21B,26B 'malici':35B 'mishandl':30B 'owner':37B 'password':71B 'point':44B 'read':55B 'recoveri':66B 'reset':69B 'rest':28B 'self':23B 'self-host':22B 'session':31B,50B 'takeov':76B 'token':42B 'user':47B 'victim':59B","search_c":"'access':117C 'account':84C,123C,130C 'activ':110C 'allow':113C 'api':86C 'attack':115C 'chang':133C 'client':95C 'differ':107C 'email':136C 'flaw':78C 'found':80C 'full':129C 'handl':90C 'identif':92C 'incorrect':89C 'inform':124C 'keycloak':83C 'lead':126C 'malici':94C 'manipul':98C 'modifi':119C 'owner':96C 'password':140C 'point':104C 'potenti':125C 'recoveri':135C 'reset':138C 'rest':85C 'secur':101C 'session':91C,111C 'takeov':131C 'token':102C 'user':108C 'victim':121C","first_public_at":"2026-11-06T06:16:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97367","severity":null,"published_at":"2026-11-06T06:16:45+00:00","modified_at":"2026-11-06T06:16:45+00:00","first_seen_at":"2026-11-06T06:40:13+00:00","fetched_at":"2026-11-06T06:40:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}