A vulnerability in the OIDC logout endpoint of the keycloak-services component in Red Hat Build of Keycloak allows an attacker to fix a session ID in a victim's browser before security checks are completed. This flaw enables session fixation, potentially leading to full account takeover, including administrative accounts. The issue arises from setting session cookies based on unvalidated token hints and reusing authentication session IDs during login. No effective mitigation or patch is currently available from Red Hat.