The vulnerability in Red Hat build of Keycloak 26.4 (CVE-2026-9087) involves an authorization bypass due to improper binding of the cross-session verification proof. The proof is keyed only by local userId and idpAlias, without binding to the upstream identity that was verified. Consequently, a different upstream account on the same IdP can reuse the proof to link to the victim's local account, bypassing intended authorization controls. This flaw affects all versions of Red Hat build of Keycloak prior to the release of 26.6.3. Red Hat has published security advisories (RHSA-2026:25097 and RHSA-2026:25098) that include updated Keycloak 26.6.3 images which address this vulnerability among others. The advisories recommend backing up existing installations and applying the updated images. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N), indicating network attack vector, high complexity, low privileges required, user interaction required, unchanged scope, with high confidentiality and integrity impact and no availability impact.

Successful exploitation allows an attacker controlling a second upstream account on the same identity provider to bypass authorization checks and link to a victim's local account in Keycloak. This can lead to unauthorized access to the victim's account and potentially compromise confidentiality and integrity of user data. There is no reported impact on availability. No known exploits in the wild have been reported.

Red Hat has released updated Red Hat build of Keycloak 26.6.3 images that address CVE-2026-9087 along with other vulnerabilities. Users should back up their existing installations and apply the updated Keycloak 26.6.3 packages as provided in the Red Hat advisories RHSA-2026:25097 and RHSA-2026:25098. Patch status is confirmed by the vendor advisory. No alternative or temporary mitigations are specified.