This vulnerability in Red Hat build of Keycloak 26.2 involves session fixation through the /login-actions/restart endpoint, which processes session handles without sufficient CSRF protection or validation of cookie ownership. An attacker can pre-create an authentication session and trick a victim into clicking a malicious link that resets the authentication flow state. This causes Single Sign-On (SSO) to authenticate the victim transparently, allowing the attacker to hijack the required-action form and take over the victim's account, including privileged administrative accounts. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity. Red Hat has issued an important security update in version 26.2.16 to fix this vulnerability.

An unauthenticated attacker can exploit this vulnerability to hijack authentication sessions and gain unauthorized access to user accounts, including highly privileged administrative accounts. This results in complete account takeover, compromising confidentiality, integrity, and availability of the affected system's authentication mechanisms.

Red Hat has released an official security update in Red Hat build of Keycloak version 26.2.16 that fixes this session fixation vulnerability. Users should upgrade to version 26.2.16 as soon as possible. Before applying the update, back up existing installations, including applications, configuration files, and databases. No other mitigations are indicated by the vendor advisory.