MEDIUMCVSS v3.1 6.4Vulnerability
CVE-2026-97367
A flaw was found in the Keycloak Account REST API where it incorrectly handles session identification. A malicious client owner can manipulate their own security tokens to point to a different user's active session. This allows the attacker to access and modify the victim's account information, potentially leading to a full account takeover by changing the recovery email and resetting the password.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-07T06:40:34.987550+00:00
- Epss score
- 0.00208
- Cvss severity
- MEDIUM
- Cvss score
- 6.4
- Retrieved at
- 2026-11-07T06:44:46+00:00
- Last source
- FIRST EPSS
- Score
- 6.4
- Cvss version
- 3.1
- Cve id
- CVE-2026-97367
- Cvss vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- First seen by Signal
- 2026-11-06T10:16:10+00:00
- Name
- CVE-2026-97367
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
- Published at
- 2026-11-06T06:16:45.377
- Last modified
- 2026-11-06T18:18:27.830
- Epss percentile
- 0.10978
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph