~ / search / GHSA-m6qj-3mpp-57v8

GHSA-m6qj-3mpp-57v8

Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-9087

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-services < 26.6.3 26.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

References

External links from the advisory. They lead to third-party sites.