This vulnerability involves inadequate CSRF protection and cookie ownership validation in the /login-actions/restart endpoint of Red Hat's build of Keycloak. By exploiting this, an attacker can fixate a session and cause the victim to be authenticated transparently through SSO upon visiting a malicious link. This bypasses normal authentication controls, enabling the attacker to hijack the victim's session and perform actions requiring authentication, including administrative tasks. The flaw arises from the endpoint processing session handles without sufficient security checks, leading to session fixation and authentication bypass.

Successful exploitation can result in complete account takeover, including highly privileged administrative accounts, compromising confidentiality, integrity, and availability of the affected system. The attacker does not require victim credentials and can hijack sessions via crafted links. This poses a significant risk to environments using Red Hat Build of Keycloak for authentication and SSO.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-7507 for current remediation guidance. Until an official fix is available, organizations should consider implementing compensating controls such as monitoring for suspicious login-actions requests and restricting access to the affected endpoints where feasible. Avoid directing users to untrusted links that could exploit this vulnerability.