Patch Ticker

Red Hat build of Keycloak unverified email auto-linking enables account takeover

Login servers could let attackers take over other people's accounts.

Summary

Keycloak links an identity from an external provider to an existing local account based on email alone, without checking that the provider verified that email. An attacker can take over a victim's account by using a matching unverified email at a brokered provider.

Affected when

  • Identity brokering with external providers and email-based automatic linking enabled

What to do

Update the 26.4 line to 26.4.17 and the 26.6 line to 26.6.8. For Red Hat Single Sign-On 7, no fixed version is named; check the advisory.

Update to at least the version for your product:

  • Red Hat build of Keycloak 26.4 26.4.17 or later
  • Red Hat build of Keycloak 26.6 26.6.8 or later

Products and platforms

  • Linux
  • Red Hat build of Keycloak 26.4.17
  • Red Hat build of Keycloak 26.6.8
  • Red Hat Single Sign-On 7

CVE IDs

Sources

Times

First published

First seen