EUVD-2026-31134
GHSA-m6qj-3mpp-57v8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-reachable linking flow with no Keycloak credentials needed (PR:N) but requiring victim interaction (UI:R) and control of a separate upstream IdP account plus knowledge of the target userId/idpAlias (AC:H); full account takeover yields C:H/I:H, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
6Blast Radius
ecosystem impact- 70 maven packages depend on org.keycloak:keycloak-services (36 direct, 34 indirect)
Ecosystem-wide dependent count for version 26.6.3.
DescriptionNVD
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
AnalysisAI
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstream Identity Provider to hijack a victim's local account through the cross-session account-linking flow. The cross-session verification proof is keyed only by the tuple of local userId and idpAlias without binding to the specific upstream identity that was actually verified, so the proof can be replayed against a different upstream account on the same IdP. EPSS is currently 0.03% (8th percentile) and no public exploit identified at time of analysis, but technical impact is rated total by CISA SSVC.
Technical ContextAI
Keycloak is Red Hat's open-source identity and access management server providing federation, SSO, and social login via upstream Identity Providers (IdPs) such as SAML and OIDC brokers. When a user links a local Keycloak account to an external IdP account, Keycloak generates a cross-session verification proof to confirm the linkage across the two browser sessions involved in the flow. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key): the proof's key is constructed from only the local userId and the idpAlias (the IdP configuration name), rather than also binding the specific upstream subject identifier that was just verified. Because the upstream identity is not part of the key, any account on the same configured IdP satisfies the proof's authorization check, breaking the integrity of the linking step. Affected product per CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak.
RemediationAI
Patch available per vendor advisory: apply the Red Hat errata RHSA-2026:25097 (https://access.redhat.com/errata/RHSA-2026:25097) and RHSA-2026:25098 (https://access.redhat.com/errata/RHSA-2026:25098) for the Red Hat build of Keycloak, using the exact fixed package versions listed in those advisories (not independently confirmed from the provided input). Until patching is complete, reduce exposure by disabling self-service account linking in affected realms (Realm Settings → user-profile / account-linking) so that linking must be initiated through an administrative flow - note this breaks end-user self-service for federated identities. Where account linking must remain enabled, restrict the set of brokered IdPs to those where attacker-controlled second accounts are hard to obtain (e.g., internal enterprise IdPs only, not public social providers); audit existing federated identity links via the Keycloak admin API or database to detect already-linked unexpected upstream subjects per local user, and review session/audit logs for IDENTITY_PROVIDER_LINK_ACCOUNT events around the disclosure window. The Red Hat security page at https://access.redhat.com/security/cve/CVE-2026-9087 should be treated as the authoritative remediation reference.
More in Red Hat Build Of Keycloak
View allAuthorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gai
Privilege escalation in Keycloak (Red Hat Build of Keycloak) lets an authenticated delegated admin with management right
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by su
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level a
Stored Cross-Site Scripting in Red Hat Build of Keycloak lets an authenticated administrator with `manage-client` permis
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows an administrator with only limited
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today