The vulnerability in Red Hat Build of Keycloak involves an authorization bypass through a user-controlled key. Specifically, the cross-session verification proof uses only (local userId, idpAlias) as the key and does not bind to the upstream identity that was verified. Consequently, a second upstream account on the same IdP can reuse the verification proof to link to the victim's local account, bypassing intended authorization controls. This flaw affects the integrity and confidentiality of user account linking within Keycloak.

An attacker controlling a second upstream account on the same identity provider can exploit this flaw to link their account to another user's local account in Keycloak. This compromises the integrity and confidentiality of user account associations, potentially allowing unauthorized access to resources or data linked to the victim's account. There is no reported impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9087 for current remediation guidance. No official fix or temporary workaround is indicated in the advisory content provided. Users should monitor the vendor advisory for updates and apply patches promptly once available.