Advisory · CVE-2026-112208
Keycloak Organizations login flaw hands over victim accounts
A stale login flag in Keycloak's Organization identity-first login flow lets an attacker in two organizations switch paths and be treated as a victim user.
- Vendor
- Keycloak
- Product
- Keycloak
- Identifier / CWE
- CVE-2026-112208
CWE-305 - Action timing
- Immediate
Explain it like I’m five
Keycloak puts a 'logged in' sticker on a visitor, then forgets to peel it off when the visitor switches lines. The visitor can then point at someone else's name and be waved through as them.
- 01Attacker logs in
An attacker who belongs to multiple organizations starts a login in Keycloak's Organization identity-first flow and authenticates successfully.
- 02Path switch
The attacker switches to a registration or password reset path, and is removed from the session.
- 03Stale flag survives
The flag marking a successful login is not cleared when the user is removed from the session.
- 04Victim username presented
The attacker supplies a victim's username, and Keycloak treats the stale flag as proof of the victim's identity.
- 05Full account takeover
The attacker gains full access to the victim's account, session, and connected applications.
What happened
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. When an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path, a flag indicating a successful login is not properly cleared when the user is removed from the session. The attacker can then provide a victim’s username, and Keycloak incorrectly treats the stale flag as proof of the victim’s identity.
Red Hat rates the issue Important at CVSS 8.1. Successful exploitation allows full account takeover and session hijacking of a victim user. The flaw only affects deployments with the Organization feature enabled, and the attacker must have membership in at least two organizations. Red Hat states that no mitigation is currently available.
What to do
- Identify Keycloak realms with the Organization feature enabled, especially those where users belong to multiple organizations.
- If the Organization feature is not needed, disable it until a fixed release is applied.
- Upgrade to the vendor’s fixed Keycloak release when it is published and confirm the deployed version.
- Review authentication and session logs for logins that switched between the identity-first login path and registration or password reset paths.
- For any session that looks wrong, terminate it, reset the affected account’s credentials, and check for changes to the account or its connected applications.
Management note
This is a full account takeover that needs no victim interaction and no password, only membership in two organizations. Any realm running the Organizations feature should patch as soon as a fixed release exists, because the attacker walks in through the front door of the login flow itself.