CVE-2026-9087

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

State: Published
Severity: 6.4 Medium
Published: May 20, 2026
Updated: Aug 3, 2026
Reserved: May 20, 2026

Description

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

Scores

CVSS	Score	Vector	Source
3.1	6.4 Medium	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N	redhat

Weaknesses

CWE-639 Authorization Bypass Through User-Controlled Key

Affected Products

Product	Versions
Red Hat build of Keycloak 26.4Red Hat	26.4.13-1 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat	26.4-19 and laterNot affected
Red Hat build of Keycloak 26.4Red Hat	26.4-19 and laterNot affected
Red Hat build of Keycloak 26.4.13Red Hat
Red Hat build of Keycloak 26.6Red Hat	26.6.3-3 and laterNot affected
Red Hat build of Keycloak 26.6Red Hat	26.6-6 and laterNot affected
Red Hat build of Keycloak 26.6Red Hat	26.6-6 and laterNot affected
Red Hat build of Keycloak 26.6.3Red Hat

References

RHSA-2026:25097vendor-advisory
RHSA-2026:25098vendor-advisory
RHSA-2026:30049vendor-advisory
RHSA-2026:30050vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-9087vdb-entry
RHBZ#2480172issue-tracking

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.