CVE-2026-15571: Predictable from Observable State in Red Hat Red Hat build of Keycloak 26.6
CVE-2026-15571 is a vulnerability in the legacy client-initiated account-linking endpoint of Red Hat build of Keycloak 26.6. The flaw allows a malicious OpenID Connect (OIDC) client to predict the hash used to protect the account-linking process. By tricking a user into authenticating, the attacker can forge a valid linking URL, linking the victim's account to an attacker-controlled external identity, resulting in full account takeover.
AI Analysis
Technical Summary
This vulnerability arises from the use of a predictable hash in the client-initiated account-linking endpoint of Keycloak. The hash, intended to protect against unauthorized account linking, can be predicted by a malicious OIDC client due to predictable session identifiers and client-known metadata used in its construction. Exploitation enables an attacker to link their external identity to a victim's account after tricking the victim into authenticating, thereby allowing the attacker to impersonate the victim and gain full access to their account within the realm.
Potential Impact
Successful exploitation leads to full account takeover, allowing an attacker to log in as the victim. This compromises confidentiality and integrity of the victim's account. The vulnerability does not affect availability. The severity is rated as high with a CVSS v3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
Mitigation Recommendations
Red Hat has released an official security update in Red Hat build of Keycloak 26.6.6 that addresses this vulnerability. Users are advised to update to version 26.6.6 or later. Before applying the update, back up existing installations including applications, configuration files, and databases. No additional mitigations are specified or required beyond applying the official fix.
CVE-2026-15571: Predictable from Observable State in Red Hat Red Hat build of Keycloak 26.6
Description
CVE-2026-15571 is a vulnerability in the legacy client-initiated account-linking endpoint of Red Hat build of Keycloak 26.6. The flaw allows a malicious OpenID Connect (OIDC) client to predict the hash used to protect the account-linking process. By tricking a user into authenticating, the attacker can forge a valid linking URL, linking the victim's account to an attacker-controlled external identity, resulting in full account takeover.
CVSS v3.1
Score 7.3high
Affected software
Red Hat
Red Hat build of Keycloak 26.6
Red Hat
Red Hat build of Keycloak 26.6
Red Hat
Red Hat build of Keycloak 26.6.6
Red Hat
Red Hat Data Grid 8
Red Hat
Red Hat JBoss Enterprise Application Platform Expansion Pack
Red Hat
Red Hat Single Sign-On 7
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from the use of a predictable hash in the client-initiated account-linking endpoint of Keycloak. The hash, intended to protect against unauthorized account linking, can be predicted by a malicious OIDC client due to predictable session identifiers and client-known metadata used in its construction. Exploitation enables an attacker to link their external identity to a victim's account after tricking the victim into authenticating, thereby allowing the attacker to impersonate the victim and gain full access to their account within the realm.
Potential Impact
Successful exploitation leads to full account takeover, allowing an attacker to log in as the victim. This compromises confidentiality and integrity of the victim's account. The vulnerability does not affect availability. The severity is rated as high with a CVSS v3.1 score of 7.3 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N).
Mitigation Recommendations
Red Hat has released an official security update in Red Hat build of Keycloak 26.6.6 that addresses this vulnerability. Users are advised to update to version 26.6.6 or later. Before applying the update, back up existing installations including applications, configuration files, and databases. No additional mitigations are specified or required beyond applying the official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-13T07:12:45.061Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/errata/RHSA-2026:56523","vendor":"Red Hat"},{"url":"https://access.redhat.com/security/cve/CVE-2026-15571","vendor":"Red Hat"}]
Threat ID: 6a84c574c6e8be0332bb23e8
Added to database: 08/18/2026, 20:49:56 UTC
Last enriched: 09/11/2026, 20:48:54 UTC
Last updated: 10/02/2026, 07:02:38 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.