CVE-2026-97367
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
Nov 06, 2026
Vendor
unknown
Description
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.