EUVD-2026-80173
GHSA-prm3-wvj6-64vx
Severity by source
AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Network-reachable broker endpoint, but needs attacker-controlled external IdP account and a prior victim link confirmation, so AC:H, PR:L, UI:R; no availability impact.
Primary rating from Vendor (redhat).
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.
AnalysisAI
Keycloak's first broker login flow leaves a temporary account-linking proof behind after a federated identity link is established or manually removed (CWE-613), allowing an attacker who controls the external identity to silently re-establish the link and authenticate as the victim without any further confirmation. The flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments that use identity brokering, and carries high confidentiality and integrity impact despite a moderate CVSS base of 6.4. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Keycloak realm configured with identity brokering - the first broker login flow and at least one external identity provider must be active, which is a non-default deployment mode rather than an out-of-the-box configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, base 6.4) is internally consistent with the description: the attacker needs network reach to the Keycloak broker endpoint, must control an account at the federated external identity provider (PR:L, attacker is a legitimate but hostile IdP user rather than anonymous), and depends on a prior victim action - confirming an account-linking request from a different browser (UI:R), which drives the AC:H rating. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version appears in the supplied data, so the immediate action is to monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-92358 for the fixed Red Hat Build of Keycloak and Red Hat Single Sign-On 7 builds and apply them as soon as they are published; treat any upgrade that touches the first broker login flow as the authoritative fix, and verify the patched version after deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Build Of Keycloak
View allAccount takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in
Account takeover in Keycloak (Red Hat build of Keycloak, Red Hat Single Sign-On 7) arises because the IdP-initiated SAML
Authentication bypass in Red Hat Build of Keycloak (and Red Hat Single Sign-On 7) lets an unauthenticated attacker forge
Privilege escalation in Red Hat Build of Keycloak's Dynamic Client Registration (DCR) grants an attacker with low-privil
Authorization bypass in the Keycloak Policy Enforcer allows any authenticated user to circumvent all enforced access con
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to re
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accou
Token exchange in Keycloak bypasses Google Workspace domain allowlist restrictions, enabling any valid Google account ho
Signature-verification bypass in Keycloak (and Red Hat's Keycloak-based products such as Red Hat Single Sign-On 7 and Re
Tenant-restriction bypass in Keycloak's Microsoft identity provider integration allows attackers holding any valid Micro
Session hijacking via SAML assertion replay in Keycloak's SAML broker component allows adjacent-network attackers to aut
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abus
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today