Keycloak-services: keycloak-services: dcr azp and sid claim substitution allows account rest session takeover

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.

Etkilenen sürümler2 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• bugzilla.redhat.com/show_bug.cgi Üçüncü taraf
• access.redhat.com/security/cve/CVE-2026-97367 Diğer

Kayıt geçmişi

1. 6 Kas 2026 09:03Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-9797Keycloak: keycloak: privilege escalation via client authentication manipulation by an authenticated administrator
• 6,5 CVE-2026-97848Keycloak-services: keycloak-services: protocol mapper with jsontype=json bypasses token sanitization
• 6,5 CVE-2026-96547Keycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles
• 5,4 CVE-2026-96460Keycloak-services: keycloak-services: indefinite access token renewal via standard token exchange v2
• 6,8 CVE-2026-19688Keycloak-services: keycloak-services: admin api missing audience check
• 4,9 CVE-2026-92856Keycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints