← CVE Radar
CVE-2026-97175Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
8.8 HIGHEPSS 0.35%Not in KEVNVD: Awaiting Analysis
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.8 | HIGH | 3.1redhat (CNA) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-97175
- Status
- Awaiting Analysis
- Assigner (CNA)
- redhat
- Published
- Nov 5, 2026
- Last modified
- 2026-11-06 20:17 UTC
- Weaknesses
- CWE-287 · Improper Authentication
Affected Products
As published by the CNA in the CVE record.
Red HatRed Hat build of Keycloak 26.4.170 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.4.170 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.6.80 version ranges
No version detail published.
Red HatRed Hat build of Keycloak 26.6.80 version ranges
No version detail published.
Red HatRed Hat Single Sign-On 70 version ranges
No version detail published.
References
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95759
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95760
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95761
- access.redhat.com https://access.redhat.com/errata/RHSA-2026:95762
- access.redhat.com https://access.redhat.com/security/cve/CVE-2026-97175