Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-92358— Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

Quick assessment

Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Keycloak 的第一个 broker 登录流程中发现了一个漏洞。当用户在另一个浏览器中确认账户链接请求时，系统会创建一个临时证明（proof）用于验证该链接。然而，在链接建立之后，或用户随后手动移除链接时，该临时证明未被正确清除。攻击者若控制了外部身份（external identity），可以利用残留的该证明悄悄重新建立链接，从而在无需进一步确认的情况下，非法获取对受害者账户的未授权访问权限。

CVSS 6.4 · Medium EPSS 0.27% · P20

Possible ATT&CK Techniques 2 AI

T1141.002 T1531.001

Affected Version Matrix 4

VendorProduct Version RangeStatus
Red Hat Red Hat Build of Keycloak any affected
any affected
any affected
Red Hat Red Hat Single Sign-On 7 any affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92358

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Build of Keycloak - cpe:/a:redhat:build_keycloak:
Red Hat Red Hat Single Sign-On 7 - cpe:/a:redhat:red_hat_single_sign_on:7

II. Public POCs for CVE-2026-92358

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92358

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-92358 (1)

Same Patch Batch · Red Hat · 2026-09-16 · 10 CVEs total

CVE-2026-74909 8.1 HIGH Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enfo
CVE-2026-85469 8.0 HIGH Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to m
CVE-2026-79651 7.5 HIGH Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
CVE-2026-18212 7.5 HIGH Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
CVE-2026-42784 7.4 HIGH Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusio
CVE-2026-17526 7.2 HIGH Keycloak-services: keycloak-services: privilege escalation via impersonation role allows t
CVE-2026-92615 6.6 MEDIUM Flightctl: flightctl: package-global go-git https transport mutated per-repo -- cross-tena
CVE-2026-92091 5.9 MEDIUM Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops
CVE-2026-19607 5.3 MEDIUM Keycloak-services: keycloak-services: broker-originated username collision causes account

IV. Related Vulnerabilities

Same product: Red Hat Build of Keycloak
Same vendor: Red Hat
Same weakness: CWE-613