---
id: "CVE-2026-97175"
kind: "vulnerability"
aliases: ["CVE-2026-97175"]
title: "Keycloak: unverified email lets attackers take over linked local accounts"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Red Hat Build of Keycloak", "fixed": [], "affected": "unknown versions (Red Hat lists as affected)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["account-takeover", "identity-brokering", "keycloak", "other", "self-hosted", "sso"]
not_affected_if: ["no-auto-account-linking", "no-identity-brokering"]
published_at: "2026-11-05T18:17:11+00:00"
first_seen_at: "2026-11-05T18:40:10+00:00"
updated_at: "2026-11-05T18:41:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97175", "first_seen_at": "2026-11-05T18:40:10+00:00"}, {"source": "analyst", "url": "https://access.redhat.com/security/cve/CVE-2026-97175", "first_seen_at": "2026-11-05T18:41:28+00:00", "cites": ["https://access.redhat.com/security/cve/CVE-2026-97175", "https://github.com/keycloak/keycloak/issues/53041"]}]
exploit_sources: []
---

# Keycloak: unverified email lets attackers take over linked local accounts

Keycloak's idp-auto-link authenticator links an external identity to an existing local account by email without checking that the provider verified that email. An attacker with an unverified matching email at a brokered identity provider can take over the victim's account.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Red Hat Build of Keycloak affected unknown versions (Red Hat lists as affected) fixed no fixed version listed

## How to check

- In each realm, open Authentication > Flows > first broker login and check whether the 'Automatically set existing user' (idp-auto-link) execution is enabled.
- Check Identity Providers for any with Trust Email on; the upstream issue describes this as the way to reach the bug, with a local account whose email is unverified.
- Red Hat Build of Keycloak (keycloak-services, rhbk/keycloak-rhel9) is listed affected by Red Hat; Red Hat Single Sign-On 7 is listed not affected. Fixed version: not published in the sources read.

## Timeline

- 2026-11-05T18:40:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97175
- 2026-11-05T18:41:28+00:00 analyst https://access.redhat.com/security/cve/CVE-2026-97175 — Red Hat CNA advisory read (Important, 8.8, reporter ProofSpear; no fixed versions, no mitigation, RHSSO 7 not affected, RHBK affected). Upstream issue keycloak#53041 (open, no fix, Keycloak 26.5 and main) describes the same idp-auto-link missing isEmailVerified check but does not cite the CVE; linked as mentions only. No fixed version found; no PoC/exploitation reported.

## Documents

- [advisory] Red Hat: CVE-2026-97175 https://access.redhat.com/security/cve/CVE-2026-97175
- [mentions] keycloak #53041: idp-auto-link links to an existing account that never verified the shared email https://github.com/keycloak/keycloak/issues/53041

## From the sources

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_