Keycloak-services: keycloak-services: oidc logout endpoint session fixation via id_token_hint leading to account takeover

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the OIDC logout endpoint of the keycloak-services component, which handles user session termination in Red Hat Build of Keycloak. The issue occurs because the system sets a session cookie based on an unvalidated token hint before completing security checks. An attacker can use this flaw to fix a session ID in a victim's browser, allowing them to hijack the victim's subsequent login and gain full control over their account.

Etkilenen sürümler2 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• access.redhat.com/errata/RHSA-2026:95761 Üretici bülteni
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-107124 Diğer

Kayıt geçmişi

1. 6 Kas 2026 13:40Etkilenen sürüm bilgisi güncellendi
2. 6 Kas 2026 08:57Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-97848Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
• 6,4 CVE-2026-97367Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover
• 6,5 CVE-2026-96547Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
• 5,4 CVE-2026-96460Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
• 6,8 CVE-2026-19688Keycloak-services: keycloak-services: admin api missing audience check
• 4,9 CVE-2026-92856Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints