CVE-2026-82968: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Build of Keycloak

This vulnerability exists in the first-broker-login flow of the Keycloak identity management service as shipped by Red Hat. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity. Consequently, an attacker controlling a different account on the same social provider can intercept the process and link their own account to the victim's local profile, gaining unauthorized access. The root cause is the failure to bind the cross-session verification proof to the specific upstream identity. Red Hat has assessed the severity as moderate, with a CVSS v3.1 score of 6.4 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N). No patch or official mitigation is currently available that meets Red Hat's standards for ease of use, applicability, and stability.

Successful exploitation allows an attacker to link their social identity to a victim's local account, resulting in unauthorized access to the victim's data and permissions. This represents an authorization bypass and horizontal privilege escalation. The attack requires user interaction and precise timing during the active account-linking process. There is no impact on availability. The vulnerability affects confidentiality and integrity with high impact.

Currently, no mitigation or patch meeting Red Hat's criteria for ease of use, applicability, and stability is available. Users should monitor the Red Hat advisory for updates. Red Hat Product Security is aware of the issue and assessing potential fixes. Until a fix is released, users should exercise caution during social identity linking processes and consider restricting or monitoring such operations if possible.