EUVD-2026-31134
GHSA-m6qj-3mpp-57v8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Network-reachable linking flow with no Keycloak credentials needed (PR:N) but requiring victim interaction (UI:R) and control of a separate upstream IdP account plus knowledge of the target userId/idpAlias (AC:H); full account takeover yields C:H/I:H, no availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6Blast Radius
ecosystem impact- 70 maven packages depend on org.keycloak:keycloak-services (36 direct, 34 indirect)
Ecosystem-wide dependent count for version 26.6.3.
DescriptionNVD
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
AnalysisAI
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstream Identity Provider to hijack a victim's local account through the cross-session account-linking flow. The cross-session verification proof is keyed only by the tuple of local userId and idpAlias without binding to the specific upstream identity that was actually verified, so the proof can be replayed against a different upstream account on the same IdP. EPSS is currently 0.03% (8th percentile) and no public exploit identified at time of analysis, but technical impact is rated total by CISA SSVC.
Technical ContextAI
Keycloak is Red Hat's open-source identity and access management server providing federation, SSO, and social login via upstream Identity Providers (IdPs) such as SAML and OIDC brokers. When a user links a local Keycloak account to an external IdP account, Keycloak generates a cross-session verification proof to confirm the linkage across the two browser sessions involved in the flow. The root cause maps to CWE-639 (Authorization Bypass Through User-Controlled Key): the proof's key is constructed from only the local userId and the idpAlias (the IdP configuration name), rather than also binding the specific upstream subject identifier that was just verified. Because the upstream identity is not part of the key, any account on the same configured IdP satisfies the proof's authorization check, breaking the integrity of the linking step. Affected product per CPE is cpe:2.3:a:red_hat:red_hat_build_of_keycloak.
RemediationAI
Patch available per vendor advisory: apply the Red Hat errata RHSA-2026:25097 (https://access.redhat.com/errata/RHSA-2026:25097) and RHSA-2026:25098 (https://access.redhat.com/errata/RHSA-2026:25098) for the Red Hat build of Keycloak, using the exact fixed package versions listed in those advisories (not independently confirmed from the provided input). Until patching is complete, reduce exposure by disabling self-service account linking in affected realms (Realm Settings → user-profile / account-linking) so that linking must be initiated through an administrative flow - note this breaks end-user self-service for federated identities. Where account linking must remain enabled, restrict the set of brokered IdPs to those where attacker-controlled second accounts are hard to obtain (e.g., internal enterprise IdPs only, not public social providers); audit existing federated identity links via the Keycloak admin API or database to detect already-linked unexpected upstream subjects per local user, and review session/audit logs for IDENTITY_PROVIDER_LINK_ACCOUNT events around the disclosure window. The Red Hat security page at https://access.redhat.com/security/cve/CVE-2026-9087 should be treated as the authoritative remediation reference.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today