CVE-2026-97175highCWE-287

CVE-2026-97175: fallo de gravedad alta en Red Hat build of Keycloak 26.4.17

Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat build of Keycloak+ Monitorear Red Hat Single Sign-On

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ella tiene alerta oficial del gobierno de Brasil.

ssvc Trackcvss 8.8epss 0.4%
Alerta oficial en Brasil

El gobierno federal de Brasil publicó una alerta, recomendación o boletín que cita esta vulnerabilidad.

Fuente: CTIR Gov (GSI) y CISC Gov.br, bajo licencia CC BY-ND 3.0.
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Red Hat · Red Hat build of Keycloak 26.4.17Red Hat · Red Hat build of Keycloak 26.6.8Red Hat · Red Hat Single Sign-On 7
CVEs relacionadas — Red Hat build of Keycloak 26.4.17

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-18963CRITICALKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypassEPSS 6.6%CVE-2023-5685HIGHXnio: stackoverflowexception when the chain of notifier states becomes problematically bigEPSS 3.5%CVE-2024-3656HIGHKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalitiesEPSS 3.3%CVE-2024-5971HIGHUndertow: response write hangs in case of java 17 tlsv1.3 newsessionticketEPSS 2.9%CVE-2026-93567HIGHIo.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityEPSS 2.9%CVE-2024-7885HIGHUndertow: improper state management in proxy protocol parsing causes information leakageEPSS 2.6%