EUVD-2026-31134
GHSA-m6qj-3mpp-57v8
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionNVD
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
AnalysisAI
Account takeover via IdP linking proof reuse in Red Hat Build of Keycloak allows an authenticated attacker with an account on the same external Identity Provider to hijack another user's local Keycloak account. The cross-session verification proof generated during the IdP account linking flow is scoped only to the tuple (local userId, idpAlias) and is not cryptographically bound to the specific upstream identity that completed verification, enabling a second IdP account - controlled by the attacker - to consume that proof and become linked to the victim's local account. …
Sign in for full analysis, threat intelligence, and remediation guidance.
More from same product – last 7 days
Command injection in the shell-quote npm package allows attackers who can influence object-token inputs to inject arbitr
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today