CVE-2026-92358— Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
Quick assessment
Affected
Red Hat Red Hat Build of Keycloak
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Keycloak 的第一个 broker 登录流程中发现了一个漏洞。当用户在另一个浏览器中确认账户链接请求时，系统会创建一个临时证明（proof）用于验证该链接。然而，在链接建立之后，或用户随后手动移除链接时，该临时证明未被正确清除。攻击者若控制了外部身份（external identity），可以利用残留的该证明悄悄重新建立链接，从而在无需进一步确认的情况下，非法获取对受害者账户的未授权访问权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92358
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually removes the link. An attacker who controls the external identity can exploit this leftover proof to silently re-establish the link and gain unauthorized access to the victims account without any further confirmation.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Build of Keycloak | - |
cpe:/a:redhat:build_keycloak:
|
|
| Red Hat | Red Hat Single Sign-On 7 | - |
cpe:/a:redhat:red_hat_single_sign_on:7
|
|
II. Public POCs for CVE-2026-92358
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92358
请登录查看更多情报信息。
Other References for CVE-2026-92358 (1)
IV. Related Vulnerabilities
Same product: Red Hat Build of Keycloak
-
CVE-2026-89298
Keycloak-services: keycloak-services: confidential client se -
CVE-2026-88770
Keycloak-services: keycloak-services: device authorization g -
CVE-2026-19729
Keycloak-services: keycloak-services: incomplete fix for arb -
CVE-2026-82968
Keycloak-services: keycloak-services: cross-session email ve -
CVE-2026-79652
Keycloak-services: keycloak-services: jwt bearer authorizati
Same vendor: Red Hat
-
CVE-2026-92091
Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate c -
CVE-2025-11395
Podman: arbitrary file write when importing oci archive -
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-79699
Podman: buildah: skopeo: containers/storage: malicious tar w -
CVE-2026-79705
Podman: buildah: buildah/copier: directory escape via crafte
Same weakness: CWE-613
-
CVE-2026-82310
Apache Airflow FAB provider: FAB auth manager: deactivated u -
CVE-2026-86462
Apache Airflow FAB provider: FAB Admin password PATCH does n -
CVE-2026-82311
Apache Airflow FAB provider: FAB password reset never invali -
CVE-2026-55617
Hydro: Insufficient session expiration when recreating sessi -
CVE-2026-88262
xClick R2/R3会话过期致认证绕过
V. Comments for CVE-2026-92358
No comments yet