CVE-2026-82968— Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers
Quick assessment
Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Keycloak 身份管理服务的首次登录（first-broker-login）流程中发现了一个漏洞。当用户将社交身份提供商的账户关联到其本地账户时，生成的验证凭证未严格绑定到正在验证的特定上游身份。这使得攻击者可以使用同一社交提供商下的另一个账户，截获该流程，并将自己的账户关联到受害者的本地资料，从而获得未授权的访问权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-82968
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 | - |
cpe:/a:redhat:red_hat_single_sign_on:7
|
|
II. Public POCs for CVE-2026-82968
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-82968
请登录查看更多情报信息。
Other References for CVE-2026-82968 (2)
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
-
CVE-2026-79652
Keycloak-services: keycloak-services: jwt bearer authorizati -
CVE-2026-19608
Keycloak-services: keycloak-services: name-only group claims -
CVE-2026-18967
Keycloak-services: keycloak-services: saml onetimeuse assert -
CVE-2026-18569
Keycloak-services: keycloak-services: oidc backchannel logou -
CVE-2026-18573
Keycloak-services: keycloak-services: client access-type pol
Same vendor: Red Hat
-
CVE-2026-84470
Automation-controller: automation-controller-container: auto -
CVE-2026-49329
Openshift/oauth-server: openshift/oauth-server: quadratic-ti -
CVE-2026-84270
Gvfs: mtp: out-of-bounds read in do_read() -
CVE-2026-84269
Gvfs: afp: heap-based buffer overflow in dsi read path -
CVE-2026-84267
Gvfs: sftp: uninitialized heap disclosure in read_string()
Same weakness: CWE-639
-
CVE-2026-81846
runZero MCP 'Findings summaries' Data Leak -
CVE-2026-84205
GROWI through 8.0.2 Authorization Bypass Through User-Contro -
CVE-2026-84148
Insecure Direct Object Reference Vulnerability in Manacle Te -
CVE-2026-83743
invoiceninja Invoice Ninja Vendor Portal Profile Update prof -
CVE-2026-82395
Sulu: Media move/update authorization bypass (IDOR)
V. Comments for CVE-2026-82968
No comments yet