This vulnerability exists in the org.keycloak.broker.oidc package of Red Hat Build of Keycloak. The OIDC broker incorrectly synchronizes the email_verified claim by retrieving the email address from the userinfo endpoint but the email_verified status exclusively from the id_token without validating that both refer to the same email address. If these differ, the id_token's email_verified=true claim is blindly applied to the userinfo email, allowing an attacker who controls or has compromised the upstream OIDC provider to mark arbitrary email addresses as verified. Exploitation requires the OIDC identity provider to have trustEmail set to true (a non-default setting) and the userinfo endpoint enabled (default).

An attacker controlling or compromising the upstream OIDC provider can cause Keycloak to mark arbitrary email addresses as verified. This undermines email-based security controls and verification workflows, potentially enabling account takeover if applications rely solely on the email_verified flag from the identity provider to link accounts. The CVSS 3.1 base score is 4.8 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-14781 for current remediation guidance. Until an official fix is available, avoid enabling the trustEmail=true setting in the OIDC identity provider configuration or disable the userinfo endpoint if feasible. Additionally, do not rely solely on the email_verified claim from the identity provider for critical security decisions.