The vulnerability CVE-2026-6266 affects Red Hat Ansible Automation Platform 2.5 and 2.6. It arises from the user auto-link strategy introduced in version 2.6, which links an external IDP identity to an existing AAP user account solely based on matching email addresses without verifying ownership of the email. This lack of verification enables remote attackers to potentially hijack accounts or gain unauthorized access to other accounts, including those with administrative privileges. Red Hat has issued security advisories RHSA-2026:13508 and RHSA-2026:13512 providing patches that fix this issue among other vulnerabilities. The CVSS v3.1 base score is 8.3 (high severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity with low impact on availability.

Successful exploitation of this vulnerability allows a remote attacker to bypass authentication controls by manipulating the external IDP email identity linkage, potentially hijacking victim accounts or gaining unauthorized access to other user accounts, including administrative ones. This compromises confidentiality and integrity of the affected system. The vulnerability has a high CVSS score of 8.3, indicating significant risk if exploited.

Red Hat has released official security updates for Red Hat Ansible Automation Platform versions 2.5 and 2.6 that address this vulnerability. Users should apply these updates promptly following Red Hat's published guidance in the advisories RHSA-2026:13508 and RHSA-2026:13512. No additional mitigation steps are indicated beyond applying the official patches.