Keycloak idp-auto-link Authenticator Account Takeover via Unverified Email
CVE-2026-97175 Published on November 5, 2026
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
Vulnerability Analysis
CVE-2026-97175 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Timeline
Reported to Red Hat.
Made public. 43 days later.
Weakness Type
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-97175 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2026-97175
stack.watch emails you whenever new vulnerabilities are published in Red Hat Build Keycloak or Red Hat Single Sign On. Just hit a watch button to start following.
