Keycloak CVE-2026-15571

Three concrete prerequisites must be met simultaneously. First, the legacy client-initiated account-linking endpoint must be active in the Keycloak deployment - this is explicitly described as a 'legacy' mechanism, so newer or hardened deployments that have disabled or removed this endpoint are not affected. Second, the attacker must control a registered OIDC client within the target Keycloak realm; the CVSS PR:L rating reflects this requirement - if client self-registration is disabled and the attacker has no realm access, they cannot register such a client and exploitation is blocked. Third, the victim must be actively deceived into initiating an authentication session through the attacker's client (CVSS UI:R), requiring social engineering or phishing. Exploitation is materially limited by: the user-interaction requirement ruling out automated/mass exploitation, the need for a registered client in the specific target realm, and the legacy nature of the vulnerable endpoint which may already be absent in modern deployments.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) scores 7.3 High, which is broadly consistent with the described impact. AV:N and AC:L indicate the attack is network-accessible and requires no special circumstances beyond controlling a registered client - an important prerequisite encoded in PR:L. The UI:R requirement is the primary limiting factor: exploitation depends on a victim being socially engineered into clicking a phishing link and completing an authentication flow, making mass automated exploitation unlikely. No EPSS data was provided, and the absence of a KEV listing means active exploitation is not confirmed. The account-takeover outcome (C:H/I:H) is severe and there is no scope change (S:U) since the attacker's impact is bounded to the victim's identity within the realm. Overall, real-world risk is moderate-to-high for organizations where: (a) the legacy endpoint is active, (b) client registration is open or the attacker has prior realm access, and (c) users can be targeted via phishing. For deployments with strict client registration controls, risk is meaningfully lower.

An attacker registers a malicious OIDC client in the target Keycloak realm (possible when client registration is unrestricted or the attacker has obtained low-level realm access), then sends the victim a phishing link that initiates an authentication flow through the attacker's client. By predicting the hash value used in the legacy account-linking protection mechanism, the attacker constructs a forged linking URL; once the victim authenticates, Keycloak processes the forged URL and permanently links the victim's account to the attacker's external identity, after which the attacker logs in as the victim at will. No public proof-of-concept has been identified at time of analysis.