The vulnerability exists in the org.keycloak.broker.oidc package of Red Hat Build of Keycloak. When configured with trustEmail=true and the userinfo endpoint enabled, Keycloak retrieves the email address from the userinfo response but obtains the email_verified claim exclusively from the id_token. There is no validation to ensure that the email_verified claim corresponds to the same email address returned by the userinfo endpoint. If these differ, the email_verified=true status from the id_token is incorrectly applied to the userinfo email. Exploitation requires the attacker to control or have compromised the upstream OIDC provider. This flaw can lead to marking arbitrary emails as verified, bypassing email-based security controls, and potentially account takeover.

An attacker who controls or compromises the upstream OIDC provider can cause Keycloak to mark arbitrary email addresses as verified. This undermines email verification workflows and security controls that rely on the email_verified flag. Applications that trust this flag for account linking or authentication may be vulnerable to account takeover. The CVSS score is 4.8 (medium severity), indicating limited but meaningful impact on confidentiality and integrity without availability impact.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-14781 for current remediation guidance. Until a fix is available, avoid setting trustEmail=true in OIDC identity provider configurations or ensure the upstream OIDC provider is fully trusted and secure. Review application reliance on the email_verified claim and consider additional verification mechanisms.