Flaw in the legacy client-initiated account-linking endpoint of Keycloak (CVE-2026-15571)

The legacy client-initiated account-linking endpoint in Keycloak relies on a hash to protect against unauthorized linking requests. This hash is predictable by a malicious OIDC client, which can exploit this by tricking a user into authenticating and then forging a valid linking URL. This allows the attacker to link the victim's account to an external identity controlled by the attacker, leading to full account takeover. The vulnerability is tracked as CVE-2026-15571 and affects Keycloak versions before 26.7.2. Red Hat has released security updates including Keycloak 26.6.6 to address this and other vulnerabilities.

Successful exploitation allows an attacker-controlled OIDC client to perform a full account takeover by linking the victim's account to an attacker-controlled external identity. This enables the attacker to log in as the victim, compromising account confidentiality and integrity.

A patch is available and should be applied. Red Hat has released updated packages for Keycloak 26.6.6 and corresponding container images that fix this vulnerability. Users should upgrade to Keycloak version 26.7.2 or later or apply the Red Hat security updates RHSA-2026:56523 and RHSA-2026:56524. Before updating, back up all relevant data and configurations. No additional mitigation steps are indicated by the vendor advisory.