{"id":"CVE-2026-97175","published":"2026-11-05T18:17:11.670","lastModified":"2026-11-05T18:17:11.807","description":"A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-97175","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an attacker to hijack a victim's account by linking their own unverified email from an external identity provider to the victim's existing local account in Keycloak, bypassing email verification since the auto-linking logic trusts unvalidated emails.","exploitability":"Exploitation requires the attacker to control an email address at a federated identity provider that matches the victim's email, even if unverified, and initiate authentication through that provider.","blast_radius":"Successful exploitation grants the attacker full access to the victim's account, enabling data exfiltration, privilege escalation, or further compromise within Keycloak-managed systems.","remediation":"Upgrade to Keycloak 26.1.0 or later, where the idp-auto-link authenticator now requires verified email addresses before linking identities.","detection":"Monitor for repeated authentication attempts from the same unverified external identity provider using an email that matches a pre-existing local user; look for 'idp-linking' events in Keycloak audit logs where the linked identity lacks email verification status.","tags":["auth-bypass","identity-federation","email-spoofing","account-takeover"],"model":"garnet-coder","analyzedAt":"2026-11-06T09:54:18.633Z"}}