CVE-2026-82968 Red Hat CVE debrief

Who should care

Administrators and developers using Keycloak identity management service, especially those integrating social identity providers, should review and verify social identity provider account linking implementations. They should implement additional authentication and authorization checks and monitor for suspicious account linking activity. Security teams and vulnerability management teams should also review the affected scope, severity, and vendor guidance.

Technical summary

A flaw in Keycloak's first-broker-login flow allows an attacker to intercept and link their own account to a victim's local profile, gaining unauthorized access. This vulnerability affects Keycloak identity management service, especially those integrating social identity providers. The verification proof generated is not strictly bound to the specific upstream identity being verified, allowing potential unauthorized account linking. Defenders should verify the affected scope, severity, and vendor guidance. Security teams and vulnerability management teams should also review the affected scope, severity, and vendor guidance.

Defensive priority

Medium-priority defensive review recommended due to potential unauthorized access via social identity provider account linking.

Recommended defensive actions

• Review and verify social identity provider account linking implementations
• Implement additional authentication and authorization checks
• Monitor for suspicious account linking activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

Evidence from the NVD and Red Hat sources indicates a flaw in Keycloak's first-broker-login flow, allowing potential unauthorized account linking. The CVE record was published on 2026-09-02T02:17:19.750Z and has not been modified since then. However, defenders should verify the affected scope, severity, and vendor guidance. The verification proof generated is not strictly bound to the specific upstream identity being verified, which allows an attacker with a different account on the same social provider to intercept the process.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.