CVE-2026-14781 Red Hat CVE debrief

Who should care

Administrators and users of Keycloak instances with OIDC identity providers configured with trustEmail=true and the userinfo endpoint enabled should review and update their configurations to prevent potential security bypasses. This includes verifying email addresses through other means and monitoring for suspicious activity related to email verification workflows. Additionally, security teams and operators managing Keycloak deployments should be aware of the potential impact and take necessary precautions to protect their environments. Those responsible for vulnerability management and platform security should prioritize patching or mitigating this vulnerability to prevent potential account takeovers and security bypasses. Affected teams should also consider compensating controls and enhanced monitoring for exposed systems while remediation is scheduled and verified. This involves reviewing relevant logs and detection mechanisms to ensure the security posture is maintained during the remediation process. Lastly, asset inventory managers should verify that all Keycloak instances are accounted for and assess their exposure to this vulnerability, ensuring that appropriate actions are taken based on the risk assessment. Those managing change windows and rollback processes should plan for the implementation of vendor-supported updates or mitigations through normal change control where exposure is confirmed, and track exceptions and retest remediated assets to close the item only after evidence is documented. This comprehensive approach ensures that all stakeholders are aware of their responsibilities and take necessary actions to mitigate the vulnerability effectively. The priority for these actions is medium due to the potential for account takeover if applications rely solely on the email_verified flag from the IdP to link accounts, but it should be elevated based on the specific risk assessment of each Keycloak deployment. Therefore, it is crucial for all relevant parties to be informed and involved in the remediation process to ensure a timely and effective response to this vulnerability. Keycloak administrators must assess their configurations and take steps to

Technical summary

The OIDC broker incorrectly synchronizes the email_verified claim, allowing an attacker to mark arbitrary email addresses as verified in the Keycloak database. This can lead to bypassing email-based security controls or verification workflows and potentially account takeover if the application relies solely on the email_verified flag from the IdP to link accounts. The issue arises from a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint.

Defensive priority

Medium priority due to potential account takeover if the application relies solely on the email_verified flag from the IdP to link accounts.

Recommended defensive actions

• Review and update the OIDC identity provider configuration to ensure trustEmail is set to false or use additional validation for email_verified claims.
• Implement compensating controls to verify email addresses through other means.
• Monitor for suspicious activity related to email verification workflows.
• Confirm whether affected Keycloak deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email.

Official resources