RED HAT BUILD OF KEYCLOAK · CVE-2026-97175 · Other
NO FIX YET
Keycloak's idp-auto-link authenticator links an external identity to an existing local account by email without checking that the provider verified that email. An attacker with an unverified matching email at a brokered identity provider can take over the victim's account.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Keycloak (Red Hat Build of Keycloak is confirmed affected by Red Hat) with a first broker login flow that uses idp-auto-link to attach external identities to existing local accounts by email. An attacker needs an account at a brokered identity provider with a matching email that the provider has not verified. Red Hat says a successful attack takes over the account, including changing email and password. Deployments with no identity brokering or no automatic linking can skip it. Red Hat Single Sign-On 7 is listed not affected.
Not affected if no-auto-account-linking, no-identity-brokering
Who cares account-takeover, identity-brokering, keycloak, self-hosted, sso
No fix yet, per the sources.
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.