A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE-341

https://access.redhat.com/errata/RHSA-2026:56523

https://access.redhat.com/errata/RHSA-2026:56524

https://access.redhat.com/security/cve/CVE-2026-15571

https://bugzilla.redhat.com/show_bug.cgi?id=2499591

[{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"keycloak-rhel9-container","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"versions":[{"version":"26.6-12","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"keycloak-rhel9-operator-bundle-container","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"versions":[{"version":"26.6.6-1","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6","defaultStatus":"affected","collectionURL":"https://catalog.redhat.com/software/containers/","packageName":"keycloak-rhel9-operator-container","cpes":["cpe:/a:redhat:build_keycloak:26.6::el9"],"versions":[{"version":"26.6-12","lessThan":"*","versionType":"rpm","status":"unaffected"}]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:build_keycloak:26.6"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk/keycloak-rhel9","cpes":["cpe:/a:redhat:build_keycloak:26.6"]},{"vendor":"Red Hat","product":"Red Hat build of Keycloak 26.6.6","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhbk-openshift-rhel9/rhbk-openshift-rhel9","cpes":["cpe:/a:redhat:build_keycloak:26.6"]},{"vendor":"Red Hat","product":"Red Hat Data Grid 8","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:jboss_data_grid:8"]},{"vendor":"Red Hat","product":"Red Hat JBoss Enterprise Application Platform Expansion Pack","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/jbossnetwork/restricted/listSoftware.html","packageName":"keycloak-services","cpes":["cpe:/a:redhat:jbosseapxp"]},{"vendor":"Red Hat","product":"Red Hat Single Sign-On 7","defaultStatus":"unaffected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","packageName":"keycloak-services","cpes":["cpe:/a:redhat:red_hat_single_sign_on:7"]}]