---
id: CVE-2026-82968
title: >-
  Keycloak-services: keycloak-services: cross-session email verification proof
  not bound to upstream identity for social providers
summary: >-
  A flaw was found in the first-broker-login flow of the Keycloak identity
  management service. When a user links a social identity provider account to
  their local account, the verification proof generated is not strictly bound to
  the speci…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-639
vendor: Red Hat
product: keycloak/rhbk-openshift-rhel9
affected:
  - keycloak/rhbk-openshift-rhel9
  - keycloak-services
  - rhbk/keycloak-rhel9
  - keycloak-services (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-02T13:00:34.094384Z'
published: '2026-09-02'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T10:25:35.093Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-82968'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2026:95761'
    label: 'RHSA-2026:95761'
  - url: 'https://access.redhat.com/security/cve/CVE-2026-82968'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2526318'
    label: RHBZ#2526318
tags:
  - cve.org
epss: 0.00325
epssPercentile: 0.25686
ingestedAt: '2026-11-06T10:49:35.383Z'
---

## Overview

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.

## Affected

- `keycloak/rhbk-openshift-rhel9`
- `keycloak-services`
- `rhbk/keycloak-rhel9`
- `keycloak-services (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.