CVE-2026-82968 in Keycloak
Summary
by MITRE • 09/02/2026
A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified in Keycloak represents a critical failure in the logic governing the binding of external identities to internal user accounts during the first-broker-login flow. This specific sequence is designed to allow users who do not yet have an account within the Keycloak realm to create one by authenticating through an upstream social identity provider, such as Google or Facebook. The core technical flaw lies in how the system generates and validates verification proofs for this linking process. Instead of strictly binding the cryptographic proof or session token to the specific upstream identity identifier being verified at that moment, the implementation allows for a looser association. This lack of strict binding creates an opening where the integrity of the account linkage is compromised, as the system fails to ensure that the person initiating the link is indeed the owner of the social media account they are claiming ownership of during this specific transaction.
From an operational perspective, this flaw enables a sophisticated identity theft and unauthorized access scenario known as account takeover via provider impersonation. An attacker who possesses their own valid account on the same social identity provider can intercept or manipulate the verification process intended for a victim. By exploiting the weak binding mechanism, the attacker can force the Keycloak instance to associate the victim's local user profile with the attacker's external social media credentials rather than the legitimate owner's. This effectively allows the attacker to gain full administrative control over the victim's account within the application ecosystem protected by Keycloak. The impact is severe because it bypasses traditional password-based security controls, relying instead on the trust established through third-party identity providers which are often perceived as more secure due to multi-factor authentication requirements inherent in those platforms.
This vulnerability aligns with CWE-287, Improper Authentication, specifically regarding the failure to properly verify the entity attempting to authenticate or link accounts. It also relates closely to CWE-640, Weak Password Recovery Mechanism for Forgotten Password, as it allows an attacker to hijack access by linking their own credentials to a target account, effectively resetting control without knowing the original password. In terms of the MITRE ATT&CK framework, this behavior is indicative of T1078, Valid Accounts, where attackers leverage legitimate credentials or identities to gain initial access and persist within the environment. The exploitation path typically involves social engineering combined with technical manipulation of the authentication flow, allowing the adversary to establish a foothold that appears entirely legitimate from the perspective of the application's security logs.
Mitigation strategies must focus on enforcing strict cryptographic binding between the session context and the specific upstream identity provider data during the account linking phase. Developers should ensure that verification tokens or proofs are generated with explicit references to the unique identifier of the social account being linked, preventing any substitution or interception by a different user's credentials from the same provider. Additionally, implementing additional confirmation steps for high-risk actions like account linkage can provide an extra layer of defense. Organizations relying on Keycloak should apply vendor-provided patches immediately if available and review their identity management configurations to ensure that session state is correctly validated against the originating authentication context. Regular audits of login flows and integration tests specifically targeting cross-account linking scenarios are essential to detect similar logical flaws before they can be exploited in production environments.