Threats Tagged 'cve-2026-82968'

A vulnerability exists in the first-broker-login flow of the Keycloak identity management service where the verification proof generated during social identity provider account linking is not strictly bound to the specific upstream identity. This flaw allows an attacker with a different account on the same social provider to link their account to a victim's local profile, gaining unauthorized access. Exploitation requires specific timing and user interaction during the account-linking process. The vulnerability is rated medium severity with a CVSS score of 6.4. No official patch or mitigation meeting Red Hat's criteria is currently available.

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.