EUVD-2026-69800
GHSA-2w6p-j7xq-6p7v
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Network attack requires victim's active account-linking session (AC:H, UI:R) and attacker's own social provider account (PR:L); successful exploitation yields full account access (C:H/I:H) with no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
2DescriptionCVE.org
A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.
AnalysisAI
Account takeover in Keycloak's first-broker-login flow allows a network attacker with their own account on a social identity provider to hijack a victim's active account-linking session and bind their own social identity to the victim's local Keycloak profile. The verification proof generated during the social IdP linking handshake is not cryptographically bound to the specific upstream identity being verified, enabling a substitution attack that grants the attacker persistent authenticated access to the victim's local account and any downstream SSO-protected services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target Keycloak instance must have at least one social identity provider configured and the first-broker-login flow with account-linking enabled - Keycloak deployments using only local credentials, LDAP, or Kerberos without social provider federation are not affected by this specific flaw; (2) the victim must have a pre-existing local Keycloak account that has not yet been linked to the social provider; (3) the victim must actively initiate the social IdP account-linking process during the exploit window - this is not a passive or zero-click attack (UI:R); (4) the attacker must hold a valid account on the exact same social identity provider the victim is attempting to link (PR:L); (5) the attacker must be capable of timing and intercepting the verification proof exchange during the victim's active session (AC:H). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.4 with vector AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N accurately reflects that the impact is severe if exploitation succeeds but the attack window is constrained. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Keycloak to the patched version specified in the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-82968; no exact fixed version number is confirmed in the available data, so the advisory must be consulted directly for the target release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today