CVE-2026-97175

Summary

The flaw allows an attacker to hijack a victim's account by linking their own unverified email from an external identity provider to the victim's existing local account in Keycloak, bypassing email verification since the auto-linking logic trusts unvalidated emails.

Exploitability

Exploitation requires the attacker to control an email address at a federated identity provider that matches the victim's email, even if unverified, and initiate authentication through that provider.

Blast radius

Successful exploitation grants the attacker full access to the victim's account, enabling data exfiltration, privilege escalation, or further compromise within Keycloak-managed systems.

Detection

Monitor for repeated authentication attempts from the same unverified external identity provider using an email that matches a pre-existing local user; look for 'idp-linking' events in Keycloak audit logs where the linked identity lacks email verification status.

Prioritized remediation

Upgrade to Keycloak 26.1.0 or later, where the idp-auto-link authenticator now requires verified email addresses before linking identities.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.