CVE-2026-82968: Keycloak Auth Bypass Vulnerability

CVE-2026-82968 Overview

CVE-2026-82968 is an authorization vulnerability in the first-broker-login flow of the Keycloak identity and access management service. When a user links a social identity provider account to their local Keycloak account, the verification proof generated during the flow is not strictly bound to the specific upstream identity being verified. An attacker holding a different account on the same social provider can intercept the linking process and bind their own social account to the victim's local profile. The result is unauthorized access to the victim's Keycloak account through the attacker-controlled social identity. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Successful exploitation allows an attacker to hijack a victim's Keycloak account by linking an attacker-controlled social identity, bypassing authentication and gaining full access to protected applications.

Affected Products

Keycloak identity and access management service
Red Hat build of Keycloak (per Red Hat advisory)
Applications relying on Keycloak's first-broker-login identity federation flow

Discovery Timeline

2026-09-02 - CVE-2026-82968 published to the National Vulnerability Database
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82968

Vulnerability Analysis

Keycloak's first-broker-login flow handles the case where a user authenticates through an external identity provider for the first time and links that upstream identity to an existing local account. To confirm ownership, Keycloak issues a verification proof, typically an email-based challenge, that the user must complete before the link is established.

The flaw is that this verification proof is not strictly bound to the specific upstream identity currently being processed. Because the proof does not cryptographically pin the intended provider account identifier, an attacker with any account on the same social provider can substitute their upstream identity during the linking step. Keycloak accepts the completed proof and associates the attacker's social account with the victim's local profile.

The attack requires user interaction and is not trivial to stage, which is reflected in the high attack complexity. Once the link succeeds, however, the attacker gains persistent authenticated access to the victim's account and any downstream applications federated through Keycloak.

Root Cause

The root cause is missing binding between the verification token and the upstream identity provider subject identifier. The verification proof establishes that a party controls the victim's email or local account, but it does not simultaneously prove control of the specific social identity being linked. This is a classic instance of [CWE-639], where an authorization decision depends on a key the attacker can influence.

Attack Vector

Exploitation occurs over the network and requires the victim to interact with a crafted authentication flow. The attacker initiates or intercepts a first-broker-login sequence targeting the victim's local account, supplies their own social provider identity, and induces the victim to complete the verification step. When the flow completes, Keycloak links the attacker's social account to the victim's profile. See the Red Hat CVE-2026-82968 Advisory and Red Hat Bug #2526318 Details for vendor-provided details.

Detection Methods for CVE-2026-82968

Indicators of Compromise

Unexpected IDENTITY_PROVIDER_LINK or FEDERATED_IDENTITY_LINK events in Keycloak audit logs for accounts that did not initiate the change.
First-broker-login events where the upstream provider subject identifier differs from any previously observed identifier for the same local user.
Successful authentications from new social identities immediately following a first-broker-login verification event.

Detection Strategies

Correlate Keycloak event logs across IDENTITY_PROVIDER_FIRST_LOGIN, SEND_VERIFY_EMAIL, and FEDERATED_IDENTITY_LINK events to detect mismatches between the initiating and completing identity.
Alert on account link operations that complete from an IP address, user agent, or geolocation different from the account that received the verification email.
Baseline the number of federated identities per user and flag accounts that gain a new provider link outside expected onboarding windows.

Monitoring Recommendations

Forward Keycloak admin and user event streams to a centralized SIEM or data lake for retention and correlation.
Monitor authentication anomalies such as new device or new provider logins immediately after a link event.
Track failed and repeated first-broker-login attempts against the same local account, which may indicate reconnaissance or repeated exploitation attempts.

How to Mitigate CVE-2026-82968

Immediate Actions Required

Apply the Keycloak security update referenced in the Red Hat CVE-2026-82968 Advisory as soon as fixed builds are available for your distribution.
Audit existing federated identity links for anomalies and unlink any social identities that users do not recognize.
Force re-verification of high-value accounts that have recently linked a social identity provider.

Patch Information

Red Hat has published tracking under Red Hat Bug #2526318 Details. Refer to the vendor advisory for fixed package versions applicable to upstream Keycloak and the Red Hat build of Keycloak. Apply updates through your standard package management or container image update process and restart Keycloak nodes after upgrade.

Workarounds

Disable the first-broker-login automatic account linking flow and require administrators to manually link social identities after out-of-band verification.
Enforce multi-factor authentication on all local Keycloak accounts so that a hijacked social link alone does not grant access.
Restrict which identity providers can be used for account linking to trusted, high-assurance providers only.

bash

# Example: disable automatic account linking by switching the
# first-broker-login flow to require manual review in Keycloak admin console
# Authentication > Flows > First Broker Login > copy and edit
# Set "Automatically Set Existing User" and "Confirm Link Existing Account"
# executions to DISABLED, and add a REQUIRED review step for administrators.