Keycloak Session Fixation Vulnerability in Login Actions Endpoints Allowing Account Takeover

A session fixation vulnerability exists in Keycloak's login-actions endpoints. An unauthenticated attacker can exploit this issue by pre-creating an authentication session and tricking a victim into clicking a malicious link. The attacker can use the /login-actions/restart endpoint, which lacks proper Cross-Site Request Forgery (CSRF) protection and cookie ownership validation, to reset the authentication flow. This manipulation causes Single Sign-On (SSO) to authenticate the victim automatically when they click the link, enabling the attacker to hijack the required-action form without needing the victim's credentials. Successful exploitation could result in complete account takeover, including access to highly privileged administrative accounts.

Impact

Exploitation of this vulnerability allows for full account takeover, particularly of the master-realm admin account in default Keycloak deployments.