---
id: "CVE-2026-97367"
page: "https://infrastack.ai/live/CVE-2026-97367"
kind: "vulnerability"
aliases: ["CVE-2026-97367"]
title: "Keycloak: Account REST API lets a client owner reach other users' sessions"
severity: "medium"
cvss: 6.4
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["identity", "infrastructure", "keycloak", "self-hosted"]
not_affected_if: ["single-tenant-trusted-clients"]
published_at: "2026-11-06T06:16:45+00:00"
first_seen_at: "2026-11-06T06:40:13+00:00"
updated_at: "2026-11-06T06:41:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97367", "first_seen_at": "2026-11-06T06:40:13+00:00"}]
exploit_sources: []
---

# Keycloak: Account REST API lets a client owner reach other users' sessions

Link for people: https://infrastack.ai/live/CVE-2026-97367 (this .md is for agents)

The Keycloak Account REST API mishandles session identification, so a malicious client owner can alter their own tokens to point at another user's active session. An attacker can then read and change the victim's account details, such as the recovery email, and reset the password for a full account takeover.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Keycloak version in use against the affected ranges (unknown from the sources)
- Confirm whether the Account REST API is exposed to clients you do not fully control
- Review which clients are registered and who owns them

## Timeline

- 2026-11-06T06:40:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97367

## From the sources

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_