EUVD-2026-61238
GHSA-m639-f4cw-m3hm
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Network endpoint, predictable hash means AC:L; attacker needs a registered OIDC client (PR:L); victim must authenticate through attacker's client (UI:R); no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
AnalysisAI
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concrete prerequisites must be met simultaneously. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) scores 7.3 High, which is broadly consistent with the described impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Red Hat patches RHSA-2026:56523 and RHSA-2026:56524 (https://access.redhat.com/errata/RHSA-2026:56523 and https://access.redhat.com/errata/RHSA-2026:56524); the exact patched Keycloak version number is not independently confirmed from the available data and should be verified against the errata details. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Keycloak deployments and confirm version exposure against CVE-2026-15571; initiate testing of vendor patches RHSA-2026:56523 and RHSA-2026:56524 in a staging environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-341 – Predictable from Observable State
View allSame technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today