A vulnerability in the idp-auto-link authenticator of the keycloak-services component allows an attacker to take over a victim's account by exploiting automatic linking of identities based on unverified email addresses from external identity providers. The flaw arises because Keycloak does not verify if the external provider has validated the email before linking it to a local account. This can lead to full account takeover, including changing the victim's email and password. No effective mitigation or patch is currently available according to Red Hat.