This vulnerability in Keycloak arises when an authenticated attacker merges accounts during an identity provider login and is prompted to review profile information. The attacker can change their email address to match a victim's, causing a verification email to be sent to the victim. The verification email omits the attacker's email address, enabling a phishing attack. Successful exploitation allows the attacker to gain access to the victim's account. The CVSS 3.1 score is 7.1 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges and user interaction. Red Hat has published security advisories and released fixed Keycloak 26.0.13 images to mitigate this vulnerability.

An attacker who is already authenticated can exploit this flaw to impersonate a victim by modifying their email address to the victim's during account merging. This causes a verification email to be sent to the victim, which lacks the attacker's email address, potentially tricking the victim into clicking the verification link. If the victim does so, the attacker gains access to the victim's account, compromising confidentiality, integrity, and availability of the victim's account data.

Red Hat has released updated Keycloak 26.0.13 images that fix this vulnerability. Users should back up their existing installations and apply the update as soon as possible. The vendor advisory provides official patches and recommends updating to the fixed versions. No alternative mitigations or workarounds are specified. Patch status is confirmed as fixed in the updated Keycloak 26.0.13 images.