CVE-2026-15571: Keycloak Auth Bypass Vulnerability

CVE-2026-15571 Overview

CVE-2026-15571 affects the legacy client-initiated account-linking endpoint in Keycloak, an open-source identity and access management platform maintained by Red Hat. The flaw stems from a predictable hash used to protect the account-linking flow from unauthorized requests. A malicious OpenID Connect (OIDC) client can forge a valid linking URL and, after tricking a user into authenticating, connect the victim's account to an attacker-controlled external identity. The result is a full account takeover, allowing the attacker to log in as the victim. The weakness maps to CWE-341: Predictable from Observable State.

Critical Impact
Successful exploitation grants an attacker persistent login access as the victim through a linked external identity provider, compromising confidentiality and integrity of the target account.

Affected Products

Red Hat build of Keycloak (see Red Hat CVE Details CVE-2026-15571)
Red Hat Single Sign-On components covered by RHSA-2026:56523
Additional Red Hat streams covered by RHSA-2026:56524

Discovery Timeline

2026-08-18 - CVE-2026-15571 published to the National Vulnerability Database (NVD)
2026-08-20 - Entry last modified in NVD

Technical Details for CVE-2026-15571

Vulnerability Analysis

Keycloak exposes a legacy client-initiated account-linking endpoint that federates a local Keycloak account with an external identity provider. The endpoint requires a token-like hash parameter intended to bind the request to a specific client, session, and provider. In vulnerable versions, that hash is derived from values an OIDC client can observe or control. An attacker who registers or compromises an OIDC client can therefore compute a valid hash for any target user session and craft a linking URL that Keycloak accepts as authentic.

When the victim authenticates through the attacker's client, Keycloak processes the forged link request and associates the victim's Keycloak account with an identity provider account the attacker controls. Subsequent logins through that external identity provider return the attacker to the victim's Keycloak identity, yielding a durable account takeover.

Root Cause

The root cause is a protection mechanism that relies on predictable input rather than an unpredictable, per-request secret. Because the linking hash can be reproduced by any actor with client-level knowledge, it fails as an authorization token. This is the classic predictability weakness described by CWE-341.

Attack Vector

Exploitation requires the attacker to operate a registered OIDC client on the target Keycloak realm and to convince a victim to authenticate through that client. No administrative privileges are required beyond standard client registration, and the attack works remotely over the network with user interaction limited to a normal login prompt.

No verified public proof-of-concept is available. See the Red Hat Bug Report #2499591 for vendor-supplied technical detail.

Detection Methods for CVE-2026-15571

Indicators of Compromise

Unexpected FEDERATED_IDENTITY_LINK events in the Keycloak admin event log tied to user sessions initiated by third-party clients.
New identity_provider links appearing on user accounts that the user did not initiate from their account console.
Repeated calls to the legacy /auth/realms/{realm}/broker/{provider}/link endpoint originating from a single OIDC client.

Detection Strategies

Enable full admin and user event logging in Keycloak and forward FEDERATED_IDENTITY_LINK, IDENTITY_PROVIDER_LINK_ACCOUNT, and LOGIN events to a central analytics pipeline.
Correlate account-link events with the client_id that initiated the session and alert when a non-first-party client triggers linking on privileged accounts.
Baseline the volume of account-linking requests per client and alert on statistically anomalous spikes.

Monitoring Recommendations

Review the list of registered OIDC clients and disable any client that does not require account linking.
Monitor authentication logs for repeated logins by the same user through a newly added external identity provider.
Audit user federatedIdentities collections through the Keycloak Admin REST API on a scheduled basis and flag unexpected additions.

How to Mitigate CVE-2026-15571

Immediate Actions Required

Apply the fixed Keycloak packages listed in RHSA-2026:56523 and RHSA-2026:56524 to all realms in scope.
Audit existing federatedIdentities entries for every user and remove links that cannot be attributed to the user.
Rotate sessions and force re-authentication for any account that shows unexpected identity provider linkage.

Patch Information

Red Hat has published fixed builds through the errata referenced above. Administrators running upstream Keycloak should upgrade to the release that incorporates the fix documented in the Red Hat CVE record. Confirm the deployed version after patching and validate that the legacy client-initiated linking endpoint enforces the corrected token.

Workarounds

Disable the legacy client-initiated account-linking flow where business requirements permit, and require account linking only through the authenticated account console.
Restrict OIDC client registration to trusted operators and review existing clients for legitimacy.
Enforce administrator approval for new identity provider links on high-value accounts through custom authenticator flows.

bash

# Example: list federated identities for a user via kcadm to audit unexpected links
kcadm.sh get users/{userId}/federated-identity -r {realm}