Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login
Summary
| CVE | CVE-2026-9087 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-05-20 17:16:32 UTC |
| Updated | 2026-06-26 08:16:26 UTC |
| Description | A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account. |
Risk And Classification
Primary CVSS: v3.1 8.1 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
EPSS: 0.003120000 probability, percentile 0.228540000 (date 2026-06-29)
Problem Types: CWE-639 | CWE-639 Authorization Bypass Through User-Controlled Key
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 8.1 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | [email protected] | Secondary | 6.4 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N |
| 3.1 | CNA | CVSS | 6.4 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N |
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Redhat | Build Of Keycloak | - | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4.13-1 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-19 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4 | unaffected 26.4-19 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.4.13 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6.3-3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6 | unaffected 26.6-6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Build Of Keycloak 26.6.3 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2026:25098 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:25097 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | Issue Tracking, Vendor Advisory |
| access.redhat.com/security/cve/CVE-2026-9087 | [email protected] | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2026:30049 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2026:30050 | [email protected] | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-05-20T14:53:02.458Z | Reported to Red Hat. |
| CNA | 2026-05-20T14:53:44.238Z | Made public. |
Workarounds
CNA: To mitigate this issue, configure the affected identity provider to set `trustEmail=true`. This ensures that Keycloak trusts the email address provided by the upstream identity provider, bypassing the vulnerable verification flow. This mitigation should only be applied if the upstream identity provider is fully trusted to verify email addresses and prevent malicious account creation with existing email addresses. Configuration changes may require a Keycloak service restart or reload to take effect.