Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
Affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7 setups that automatically link brokered identity providers to local accounts by email. No fix is listed yet.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Keycloak automatically links an incoming identity from an external (brokered) provider to an existing local account based on email, without verifying that the provider validated the email.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 32/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Keycloak-services component's idp-auto-link authenticator can be abused to take over a victim's local account. Remotely, an attacker with a low-privilege login at a brokered identity provider can gain full control of an account whose email matches an unverified address at that provider, because Keycloak links the identities without checking that the email was validated.
Read the original description
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure8/25Specific setups only, reachable over the network
- Reach10/20Shipped in major Linux distributions
- Severity8.8/10CVSS 8.8
- No patch5/5No patch listed yet
What would change the score
- Would score about 82 if added to CISA KEV
- Would score about 77 if CISA's SSVC rates exploitation active
- Would score about 39 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Keycloak automatically links an incoming identity from an external (brokered) provider to an existing local account based on email, without verifying that the provider validated the email.Workaround: The checked facts do not list a workaround. Until a fix is available, follow the guidance in Red Hat's advisory for limiting this behavior.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- keycloak-services
Version range not reported
- rhbk/keycloak-rhel9
Version range not reported
- keycloak-services
Version range not reported
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-97175
Is CVE-2026-97175 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Keycloak links an identity from an external identity provider to an existing local account by matching email, without checking that the provider verified that email. Someone who controls such an external identity can take over the local account, including changing its email and password.Source: access.redhat.com
Am I affected, and how do I check?
The checked facts list Red Hat Build of Keycloak and Red Hat Single Sign-On 7 without version ranges. The relevant setup is one where an external identity provider is brokered and incoming identities are auto-linked to local accounts by email. Check your Keycloak version and identity provider linking settings against Red Hat's advisory.Source: access.redhat.com
How do I fix CVE-2026-97175?
The checked facts do not name a fixed release, so no upgrade target can be given from them. Check Red Hat's advisory for the patched version of your product line and upgrade to it.Source: access.redhat.com
What if there's no patch?
The checked facts do not list a workaround. Until a fix is available, follow the guidance in Red Hat's advisory for limiting this behavior.Source: access.redhat.com