CVE-2026-15571: Keycloak predictable account-linking hash enables account takeover

Vulnerability Overview Vulnerability ID: CVE-2026-15571 Vulnerability Title: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client Status: NEW Priority: high Severity: high Reported Date: 2026-07-13 07:13 UTC by OSIDB Bzimport Modified Date: 2026-08-18 19:49 UTC Scope Product: Security Response Component: vulnerability Hardware: All Operating System: Linux Target Milestone: Not specified Assigned To: Product Security Remediation Fixed Version: Not specified Cloned From: Not specified Environment: Not specified Last Closed: Not specified Frozen: Not specified Detailed Description Vulnerability Description: - A vulnerability was identified in the component, specifically within the legacy client-initiated account linking endpoint ( ). This endpoint verifies a CSRF protection hash calculated as . - The root cause is that all four inputs to this hash are accessible to registered OIDC clients. - The is chosen by the attacker. - The is leaked in the standard OIDC authorization response (handled by ). - The and are known to the client. Attack Scenario: - By obtaining the victim's during the normal login flow, a malicious client can compute the required hash and generate a valid account linking URL. - If the client possesses the role (granted by default via ), the attacker can silently link their own upstream Identity Provider (IDP) identity to the victim's Keycloak account. Specific Impact: - Account Takeover: The attacker can gain full access to the victim's account by logging in with the newly linked IDP. - Unauthorized Identity Linking: The attacker can link multiple malicious identities to a single Keycloak account. - Data Exfiltration: The attacker can access all applications and data authorized by the victim. Attachments Attachment Description: - Provides a detailed description of the specific vulnerability details and attack scenarios. Additional Information CC List: 29 users (clone) Dependencies: depends on / blocked Tree View: Not specified Notes Login is required to comment or make changes to this bug.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-15571: Keycloak predictable account-linking hash enables account takeover