{"id":"CVE-2026-112208","kind":"vulnerability","aliases":["CVE-2026-112208"],"related":[],"title":"Keycloak: stale login flag lets attacker take over victim accounts","description":"A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.","summary":"In Keycloak's Organization identity-first login flow, a successful-login flag is not cleared when a user is removed from the session during a switch to registration or password reset. An attacker who belongs to multiple organizations can supply a victim's username and be treated as the victim, gaining full access to the account and connected applications.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"keycloak","fixed":["26.8.2","26.6.8"],"affected":"reproduced on 26.8.1; full affected range not published in the sources read","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","keycloak","organizations","self-hosted","sso"],"not_affected_if":["no-organizations-feature"],"how_to_check":"Check your Keycloak version (admin console footer, or /opt/keycloak/bin/kc.sh --version). It was reproduced on 26.8.1, so anything below 26.8.2 on the 26.8 line is affected, and the 26.6 line before 26.6.8 is likely affected. Then check whether Organizations are enabled and whether the realm's browser flow uses the Organization identity-first login. Realms without Organizations are likely not exposed; the issue page doesn't say so outright.","fix":"Upgrade to Keycloak 26.8.2 (released 2026-11-05). The upstream issue is also labelled for release 26.6.8 on the 26.6 line; I did not read a 26.6.8 release page.","status":"open","published_at":"2026-11-05T17:17:38+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","triaged_at":"2026-11-05T17:42:19+00:00","updated_at":"2026-11-05T17:45:07+00:00","category":"infrastructure","confidence":0.75,"triage":{"at":"2026-11-05T17:42:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: stale login flag lets attacker take over victim accounts","impact":"high","summary":"In Keycloak's Organization identity-first login flow, a successful-login flag is not cleared when a user is removed from the session during a switch to registration or password reset. An attacker who belongs to multiple organizations can supply a victim's username and be treated as the victim, gaining full access to the account and connected applications.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["keycloak","self-hosted","sso"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker logs in as any victim and reaches connected applications","analyst_note":"Check the NVD entry and the Keycloak security advisory for affected and fixed versions and whether the Organization feature is required to trigger it.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-organizations-feature"],"who_is_affected":"Organizations running Keycloak as their identity provider with the Organization identity-first login flow in use, where users belong to multiple organizations. Deployments that do not use organizations or identity-first login are likely not exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4317,"output_tokens":476,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Keycloak security advisory for affected and fixed versions and whether the Organization feature is required to trigger it.","search":"'-112208':13A,16A '-2026':12A,15A 'access':79B,111C,200C 'account':10A,82B,205C 'allow':191C 'applic':85B,118C,208C 'attack':6A,59B,126C,167C,193C 'authent':101C,196C 'belong':61B,128C 'bypass':195C 'clear':41B,157C 'connect':84B,207C 'cve':11A,14A 'first':31B,95C 'flag':4A,38B,149C,182C 'flaw':87C 'flow':33B,97C 'found':89C 'full':78B,199C 'gain':77B,198C 'host':23B 'ident':30B,94C,109C,189C 'identity-first':29B,93C 'incorrect':178C 'indic':150C 'infrastructur':18B 'initi':132C 'issu':122C 'keycloak':1A,17A,19B,26B,100C,103C 'let':5A 'login':3A,32B,37B,96C,134C,153C 'manag':112C 'modern':117C 'multipl':63B,130C 'occur':123C 'open':107C 'open-sourc':106C 'organ':20B,28B,64B,92C,131C 'password':56B,142C 'path':144C 'process':147C 'proof':184C 'proper':156C 'provid':170C 'registr':54B,140C 'remov':46B,162C 'reset':57B,143C 'secur':116C 'self':22B 'self-host':21B 'server':102C 'servic':120C 'session':49B,165C 'solut':113C 'sourc':108C 'sso':24B 'stale':2A,181C 'success':36B,152C 'successful-login':35B 'suppli':66B 'switch':52B,137C 'system':177C 'take':7A 'treat':73B,179C 'use':114C 'user':44B,160C 'usernam':70B,174C 'victim':9A,68B,76B,172C,187C,203C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Keycloak deployments that use the Organizations feature with the identity-first login flow. An attacker who belongs to more than one organization can start a login, switch to registration or password reset, then supply a victim's username and be treated as that user. Deployments without Organizations can likely skip it, but the Keycloak issue doesn't state that.","tier":"B","verified":{"fix":{"at":"2026-11-05T17:45:07Z","by":"analyst","doc":"https://www.keycloak.org/2026/11/keycloak-2682-released","run_id":1805}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["keycloak"],"ptokens":["keycloak"],"labels":["high","infrastructure","keycloak","organizations","selfhosted","sso"],"campaign_type":null,"first_public_at":"2026-11-05T17:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112208","severity":null,"published_at":"2026-11-05T17:17:38+00:00","modified_at":"2026-11-05T17:17:38+00:00","first_seen_at":"2026-11-05T17:40:03+00:00","fetched_at":"2026-11-05T17:40:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112208:1805","url":"https://github.com/keycloak/keycloak/issues/54688","severity":null,"published_at":"2026-11-05T17:45:07+00:00","modified_at":"2026-11-05T17:45:07+00:00","first_seen_at":"2026-11-05T17:45:07+00:00","fetched_at":"2026-11-05T17:45:07+00:00","note":"Keycloak 26.8.2 release notes list the CVE as a security fix, and upstream issue #54688 (reproduced on 26.8.1) carries the 26.8.2 and 26.6.8 release labels. Affected lower bound and the exact Organization requirement are not stated in the sources. No exploitation or public PoC seen. X and mitigations not checked.","cites":["https://github.com/keycloak/keycloak/issues/54688","https://www.keycloak.org/2026/11/keycloak-2682-released"]}],"documents":[{"id":78342,"url":"https://github.com/keycloak/keycloak/issues/54688","title":"[CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78345,"url":"https://www.keycloak.org/2026/11/keycloak-2682-released","title":"Keycloak 26.8.2 released","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}