---
id: "CVE-2026-112208"
kind: "vulnerability"
aliases: ["CVE-2026-112208"]
title: "Keycloak: stale login flag lets attacker take over victim accounts"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "keycloak", "fixed": ["26.8.2", "26.6.8"], "affected": "reproduced on 26.8.1; full affected range not published in the sources read", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "keycloak", "organizations", "self-hosted", "sso"]
not_affected_if: ["no-organizations-feature"]
published_at: "2026-11-05T17:17:38+00:00"
first_seen_at: "2026-11-05T17:40:03+00:00"
updated_at: "2026-11-05T17:45:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112208", "first_seen_at": "2026-11-05T17:40:03+00:00"}, {"source": "analyst", "url": "https://github.com/keycloak/keycloak/issues/54688", "first_seen_at": "2026-11-05T17:45:07+00:00", "cites": ["https://github.com/keycloak/keycloak/issues/54688", "https://www.keycloak.org/2026/11/keycloak-2682-released"]}]
exploit_sources: []
---

# Keycloak: stale login flag lets attacker take over victim accounts

In Keycloak's Organization identity-first login flow, a successful-login flag is not cleared when a user is removed from the session during a switch to registration or password reset. An attacker who belongs to multiple organizations can supply a victim's username and be treated as the victim, gaining full access to the account and connected applications.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:keycloak affected reproduced on 26.8.1; full affected range not published in the sources read fixed 26.8.2, 26.6.8

## How to check

Check your Keycloak version (admin console footer, or /opt/keycloak/bin/kc.sh --version). It was reproduced on 26.8.1, so anything below 26.8.2 on the 26.8 line is affected, and the 26.6 line before 26.6.8 is likely affected. Then check whether Organizations are enabled and whether the realm's browser flow uses the Organization identity-first login. Realms without Organizations are likely not exposed; the issue page doesn't say so outright.

## Fix

Upgrade to Keycloak 26.8.2 (released 2026-11-05). The upstream issue is also labelled for release 26.6.8 on the 26.6 line; I did not read a 26.6.8 release page.

## Timeline

- 2026-11-05T17:40:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112208
- 2026-11-05T17:45:07+00:00 analyst https://github.com/keycloak/keycloak/issues/54688 — Keycloak 26.8.2 release notes list the CVE as a security fix, and upstream issue #54688 (reproduced on 26.8.1) carries the 26.8.2 and 26.6.8 release labels. Affected lower bound and the exact Organization requirement are not stated in the sources. No exploitation or public PoC seen. X and mitigations not checked.

## Documents

- [advisory] [CVE-2026-112208] Account takeover via stale SSO_AUTH note in Organization identity-first login https://github.com/keycloak/keycloak/issues/54688
- [fix] Keycloak 26.8.2 released https://www.keycloak.org/2026/11/keycloak-2682-released

## From the sources

A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_