{"id":"CVE-2026-97175","kind":"vulnerability","aliases":["CVE-2026-97175"],"related":[],"title":"Keycloak: unverified email lets attackers take over linked local accounts","description":"A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.","summary":"Keycloak's idp-auto-link authenticator links an external identity to an existing local account by email without checking that the provider verified that email. An attacker with an unverified matching email at a brokered identity provider can take over the victim's account.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Red Hat Build of Keycloak","fixed":[],"affected":"unknown versions (Red Hat lists as affected)","ecosystem":"vendor"}],"ecosystems":[],"tags":["account-takeover","identity-brokering","keycloak","other","self-hosted","sso"],"not_affected_if":["no-auto-account-linking","no-identity-brokering"],"how_to_check":"- In each realm, open Authentication > Flows > first broker login and check whether the 'Automatically set existing user' (idp-auto-link) execution is enabled.\n- Check Identity Providers for any with Trust Email on; the upstream issue describes this as the way to reach the bug, with a local account whose email is unverified.\n- Red Hat Build of Keycloak (keycloak-services, rhbk/keycloak-rhel9) is listed affected by Red Hat; Red Hat Single Sign-On 7 is listed not affected. Fixed version: not published in the sources read.","fix":null,"status":"open","published_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","triaged_at":"2026-11-05T18:40:20+00:00","updated_at":"2026-11-05T18:41:28+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T18:40:20Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Keycloak: unverified email lets attackers take over linked local accounts","impact":"high","summary":"Keycloak's idp-auto-link authenticator links an external identity to an existing local account by email without checking that the provider verified that email. An attacker with an unverified matching email at a brokered identity provider can take over the victim's account.","audience":"businesses","category":"other","nicknames":[],"who_cares":["keycloak","self-hosted","sso"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker takes over victim accounts via unverified email at brokered provider.","analyst_note":"Find the affected and fixed Keycloak versions and the NVD/vendor advisory for CVE-2026-97175.","how_to_check":"- Check whether Keycloak identity brokering with automatic account linking (idp-auto-link, first broker login flow) is enabled in the realm settings\n- Confirm the Keycloak version in use against the fixed versions listed by the source (unknown from the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["no-identity-brokering","no-auto-account-linking"],"who_is_affected":"Organizations running Keycloak as an identity provider that brokers logins from external identity providers and automatically links them to existing local accounts by email. Deployments without identity brokering or without automatic email-based linking are likely not exposed. The sources do not name affected versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000696,"input_tokens":4247,"output_tokens":542,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Keycloak versions and the NVD/vendor advisory for CVE-2026-97175.","search":"'-2026':12A,15A '-97175':13A,16A 'account':10A,23B,49B,78B,119C,145C 'account-takeov':22B 'address':124C,152C 'allow':136C 'attack':5A,61B,138C 'authent':40B,89C 'auto':38B,87C 'automat':106C 'base':120C 'broker':27B,69B,155C 'build':19A 'check':53B 'compon':95C 'cve':11A,14A 'email':3A,51B,59B,66B,123C,133C,151C 'exist':47B,117C 'extern':43B,113C 'feder':100C 'flaw':80C 'found':82C 'handl':97C 'hat':18A 'host':32B 'ident':26B,44B,70B,99C,110C 'identity-brok':25B 'idp':37B,86C 'idp-auto-link':36B,85C 'incom':109C 'issu':102C 'keycloak':1A,21A,28B,34B,93C,105C 'keycloak-servic':92C 'let':4A 'link':8A,39B,41B,88C,107C 'local':9A,48B,118C 'match':65B,149C 'occur':103C 'of':20A 'provid':56B,71B,114C,129C,156C 'red':17A 'self':31B 'self-host':30B 'servic':94C 'sso':33B 'take':6A,73B,140C 'takeov':24B 'unverifi':2A,64B,150C 'use':147C 'user':98C 'valid':131C 'verifi':57B,126C 'victim':76B,143C 'without':52B,125C","nicknames":[],"mitigations":[],"who_affected":"Teams running Keycloak (Red Hat Build of Keycloak is confirmed affected by Red Hat) with a first broker login flow that uses idp-auto-link to attach external identities to existing local accounts by email. An attacker needs an account at a brokered identity provider with a matching email that the provider has not verified. Red Hat says a successful attack takes over the account, including changing email and password. Deployments with no identity brokering or no automatic linking can skip it. Red Hat Single Sign-On 7 is listed not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["hatbuildofkeycloak","redhatbuildofkeycloak"],"ptokens":["build","hat","keycloak","of","red"],"labels":["accounttakeover","high","identitybrokering","keycloak","other","selfhosted","sso"],"campaign_type":null,"first_public_at":"2026-11-05T18:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97175","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97175","severity":null,"published_at":"2026-11-05T18:17:11+00:00","modified_at":"2026-11-05T18:17:11+00:00","first_seen_at":"2026-11-05T18:40:10+00:00","fetched_at":"2026-11-05T18:40:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97175:1814","url":"https://access.redhat.com/security/cve/CVE-2026-97175","severity":null,"published_at":"2026-11-05T18:41:28+00:00","modified_at":"2026-11-05T18:41:28+00:00","first_seen_at":"2026-11-05T18:41:28+00:00","fetched_at":"2026-11-05T18:41:28+00:00","note":"Red Hat CNA advisory read (Important, 8.8, reporter ProofSpear; no fixed versions, no mitigation, RHSSO 7 not affected, RHBK affected). Upstream issue keycloak#53041 (open, no fix, Keycloak 26.5 and main) describes the same idp-auto-link missing isEmailVerified check but does not cite the CVE; linked as mentions only. No fixed version found; no PoC/exploitation reported.","cites":["https://access.redhat.com/security/cve/CVE-2026-97175","https://github.com/keycloak/keycloak/issues/53041"]}],"documents":[{"id":78772,"url":"https://access.redhat.com/security/cve/CVE-2026-97175","title":"Red Hat: CVE-2026-97175","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":78777,"url":"https://github.com/keycloak/keycloak/issues/53041","title":"keycloak #53041: idp-auto-link links to an existing account that never verified the shared email","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}