A flaw was found in the first-broker-login flow of the Keycloak identity management service. (CVE-2026-82968)

CVE-2026-82968 is a vulnerability in Keycloak's first-broker-login flow where the verification proof used to link a social identity provider account to a local account is not properly bound to the specific upstream identity. This allows an attacker controlling a different account on the same social provider to intercept and link their account to the victim's local profile, resulting in unauthorized access to the victim's data and permissions. The root cause is a failure to bind the cross-session verification proof to the upstream identity, classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability requires low privileges but high attack complexity and user interaction. Red Hat has assessed the severity as moderate and currently has no mitigation or fix that meets their criteria for deployment.

Successful exploitation allows an attacker to link their own social identity to a victim's local account, thereby gaining unauthorized access to the victim's data and permissions. This represents a horizontal privilege escalation and bypass of access controls. The attack requires specific timing and user interaction during an active account-linking process. There is no impact on availability. The vulnerability affects confidentiality and integrity with high impact.

Red Hat currently does not provide an official patch or mitigation that meets their criteria for ease of use, deployment, applicability, and stability. Users should monitor Red Hat advisories for updates. Given the complexity and user interaction required for exploitation, no immediate mitigation is available. Organizations should consider restricting or monitoring social identity linking processes where possible until a fix is released.