CVE-2026-15571 is a security flaw in the legacy client-initiated account-linking endpoint of Red Hat build of Keycloak 26.6.6. The protection mechanism relies on a hash that is predictable by a malicious OpenID Connect (OIDC) client. By tricking a user into authenticating, an attacker can forge a valid linking URL to link the victim's account to an attacker-controlled identity, enabling full account takeover. The root cause is the use of predictable session identifiers and client-known metadata in the construction of the account-linking CSRF protection hash. This vulnerability has a CVSS v3.1 base score of 7.3 (high severity) with network attack vector, low complexity, low privileges required, and user interaction required. Red Hat has published advisories acknowledging the issue but has not explicitly stated a patch or fix availability in the provided content.

Successful exploitation allows an attacker to link an unauthorized external identity to a victim's account, resulting in full account takeover. The attacker can then impersonate the victim across the realm, compromising confidentiality and integrity of the victim's account. There is no impact on availability. The vulnerability requires the attacker to have low privileges and trick the user into authenticating.

Patch status is not yet confirmed — check the Red Hat advisories at https://access.redhat.com/errata/RHSA-2026:56523 and https://access.redhat.com/security/cve/CVE-2026-15571 for current remediation guidance. Until a fix is applied, users should be cautious of malicious OIDC clients and avoid authenticating through untrusted clients. Red Hat recommends backing up existing installations before applying updates once available.