vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-9087

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

HIGH
8.1
CVSS Score
Published: May 20, 2026 at 04:13 PM UTC
Updated: July 23, 2026 at 07:31 PM UTC
1 product affected across 1 vendorBuild of Keycloak

Using Red Hat Build of Keycloak by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Build of Keycloak - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Build of Keycloak· Red Hatcontainer
95%
All versions26.4
Vendor states this is fixed in 26.4-19 (unaffected)
Vendor states this is fixed in 26.4.13 (unaffected)
Vendor states this is fixed in 26.4.13-1 (unaffected)
Vendor states this is fixed in 26.6-6 (unaffected)
Vendor states this is fixed in 26.6.3 (unaffected)
Vendor states this is fixed in 26.6.3-3 (unaffected)

References (6)

VDB Entryx_refsource_REDHATVendor Advisory
Source: cverecord
https://access.redhat.com/security/cve/CVE-2026-9087
Issue Trackingx_refsource_REDHATVendor Advisory
Source: cverecord
https://bugzilla.redhat.com/show_bug.cgi?id=2480172
Vendor Advisoryx_refsource_REDHAT
Source: cverecord
https://access.redhat.com/errata/RHSA-2026:25098
Vendor Advisoryx_refsource_REDHAT
Source: cverecord
https://access.redhat.com/errata/RHSA-2026:25097
Vendor Advisoryx_refsource_REDHAT
Source: cverecord
https://access.redhat.com/errata/RHSA-2026:30049
Vendor Advisoryx_refsource_REDHAT
Source: cverecord
https://access.redhat.com/errata/RHSA-2026:30050

SSVC — Action Prioritization

SSVCNo known exploitNot automatableTotal impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.1HIGH[email protected]
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-639

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card