The vulnerability in Red Hat build of Keycloak 26.4 involves an authorization bypass due to the cross-session verification proof being keyed only by local userId and idpAlias, without binding to the upstream identity that was verified. This flaw allows a second upstream account on the same IdP to consume the verification proof and link to the victim's local account, potentially enabling unauthorized account access. The CVSS 3.1 base score is 6.4 (medium severity) with network attack vector, high complexity, low privileges required, user interaction needed, unchanged scope, and high confidentiality and integrity impacts. Red Hat has published advisories (RHSA-2026:25097 and RHSA-2026:25098) releasing new Keycloak 26.6.3 images that include fixes for this and other vulnerabilities. The advisories recommend updating to these new images to remediate the issue. No explicit patch or fix is listed solely for CVE-2026-9087, but the updated images address it. The vulnerability affects all versions of Red Hat build of Keycloak prior to 26.6.3. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability allows an attacker controlling a second upstream account on the same identity provider to bypass authorization controls and link to a victim's local account in Keycloak. This can lead to unauthorized access to the victim's account and compromise confidentiality and integrity of user data. The vulnerability does not impact availability. The CVSS score of 6.4 reflects a moderate risk with significant confidentiality and integrity impact but requires user interaction and has high attack complexity.

Red Hat has released updated Keycloak 26.6.3 images that address CVE-2026-9087 along with other security issues. Users of Red Hat build of Keycloak should update to version 26.6.3 or later as provided in the Red Hat advisories RHSA-2026:25097 and RHSA-2026:25098. Before updating, back up existing installations including applications, configuration files, and databases. No alternative workarounds or mitigations are specified. Patch status is confirmed by the vendor advisories. There are no known exploits in the wild at this time.