The vulnerability in Keycloak occurs during the account merge process in an identity provider login flow. An authenticated attacker is prompted to review profile information and can change their email address to that of a victim's account. This triggers a verification email sent to the victim's email address, but the email does not disclose the attacker's address, creating a phishing opportunity. If the victim clicks the verification link, the attacker can gain unauthorized access to the victim's account. The CVSS 3.1 score is 7.1 (High), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges and user interaction with high attack complexity.

Successful exploitation allows an attacker to gain access to another user's account by tricking the victim into clicking a verification link sent to their email. This compromises confidentiality, integrity, and availability of the victim's account. The attack leverages phishing via the email verification mechanism, potentially leading to account takeover.

Red Hat has released security updates for the Red Hat build of Keycloak version 26.0.13 that address this vulnerability. Users should apply these updates to remediate the issue. Before updating, back up all relevant data including applications, configuration files, and databases. No indication was found that the vulnerability is already mitigated or requires no action. Patch status is confirmed by Red Hat advisories linked in the vendor advisory content.