CVE-2026-9087

[CVE catalog]

Severity

Medium · CVSS 6.4CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Published

May 20, 2026, 2:53:44 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.31% · Oct 25, 2026

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account. keycloak: Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login Important: A flaw in Keycloak's cross-session email verification allows an attacker to gain persistent access to a victim's local account. This occurs when an attacker controls an upstream identity provider account sharing an email with the victim, and the victim is actively linking their account while email verification is enabled and the identity provider is configured with `trustEmail=false`. The attacker can then consume the verification proof, linking their account to the victim's. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.