What’s Vulnerable › Vulnerabilities

CVE-2026-82968: Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-02 · updated 2026-09-03
• Weakness: CWE-639

Description

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.

Affected products

• Red Hat build of Keycloak 26.4: all versions
• Red Hat Single Sign-On 7: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-82968
• https://bugzilla.redhat.com/show_bug.cgi?id=2526318

Get alerted when CVE-2026-82968 or the next vulnerability affects your stack