Advisory · CVE-2026-97175
Keycloak auto-link flaw lets an unverified email take over an account
Keycloak links a federated identity to a local account by email without checking whether the identity provider verified that email, letting an attacker take over the victim's account.
- Vendor
- Keycloak
- Product
- Keycloak
- Identifier / CWE
- CVE-2026-97175
CWE-287 - Action timing
- Immediate
Explain it like I’m five
Keycloak trusts a name tag handed over by another login service without checking whether that service actually verified the name. An attacker can show up with someone else's name tag and be let into their account.
- 01Attacker account at brokered provider
The attacker holds an account at an identity provider that Keycloak trusts for federation, using the victim's email address.
- 02Federated login
The attacker signs in through that provider, which returns an identity carrying the victim's email.
- 03Auto-link without verification
Keycloak's idp-auto-link authenticator links the incoming identity to the existing local account based on the email alone, without checking whether the provider verified it.
- 04Full account takeover
The attacker is authenticated as the victim and can change the victim's email and password, locking the real owner out.
What happened
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. When Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address, it does not verify whether the provider has validated that email.
Red Hat rates the issue Important at CVSS 8.8. An attacker who holds an account at a brokered identity provider can use a matching unverified email address to take over a victim’s account, including changing the victim’s email and password. Red Hat states that no mitigation is currently available.
What to do
- Identify Keycloak realms that use the idp-auto-link authenticator or automatic identity linking based on email.
- Disable automatic linking, or require that the external provider verifies the email address before linking, until a fixed release is applied.
- Upgrade to the vendor’s fixed Keycloak release when it is published and confirm the deployed version.
- Review authentication logs for federated logins that linked to existing accounts, especially where the provider had not verified the email.
- For any account that looks linked in error, reset its credentials, review its sessions, and check for changes to email, password, or connected applications.
Management note
This is an unauthenticated-in-effect account takeover in the identity layer itself: the attacker only needs an account at a brokered provider, not a Keycloak account. Any realm that auto-links federated identities by email should treat this as an act-now item, because a compromised Keycloak account is a key to every application behind it.