CVE-2026-92358: Keycloak Authentication Bypass Vulnerability

CVE-2026-92358 Overview

CVE-2026-92358 is a session management flaw [CWE-613] in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, Keycloak creates a temporary proof to validate the link. This proof is not cleared after the link is established or when the user later removes the link manually. An attacker who controls the external identity can reuse the leftover proof to silently re-establish the link and access the victim's account without further confirmation.

Critical Impact
An attacker controlling a linked external identity can silently regain access to a victim's Keycloak account after the account link is removed, bypassing user consent.

Affected Products

Red Hat Keycloak (see Red Hat Security Advisory for affected versions)
Red Hat Build of Keycloak
Red Hat Single Sign-On distributions

Discovery Timeline

2026-09-16 - CVE-2026-92358 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-92358

Vulnerability Analysis

The flaw resides in Keycloak's first broker login flow, which handles federation between Keycloak and external identity providers (IdPs). When a user starts an account-linking flow in one browser and completes confirmation in another, Keycloak issues a temporary proof token to bridge the two sessions and validate the link.

The issue is a lifecycle failure. The proof persists after successful linking and continues to persist after the user manually unlinks the external identity. An attacker who still controls the external IdP account can present the stale proof and be re-linked to the victim's Keycloak account without triggering the confirmation step again.

The result is unauthorized authentication as the victim. Because the linking check is silently satisfied, the victim receives no prompt and no notification. The vulnerability requires user interaction during the original linking event and elevated attack complexity, which is reflected in the medium severity rating.

Root Cause

The root cause is an insufficient session expiration issue [CWE-613]. Temporary account-linking proofs are not invalidated on two critical state transitions: successful link establishment and user-initiated link removal. This violates the principle that authentication artifacts must be single-use and bound to a specific action.

Attack Vector

The attacker must first legitimately link their attacker-controlled external identity to the victim's account through a supported social flow. After the victim unlinks the identity, the attacker replays the residual proof against the first broker login endpoint. Keycloak accepts the stale proof and silently rebinds the external identity, granting the attacker interactive access to the victim's account.

No verified public exploit code is available. See the Red Hat Security Advisory CVE-2026-92358 for technical details.

Detection Methods for CVE-2026-92358

Indicators of Compromise

Federated identity re-link events on user accounts that recently removed the same external identity provider link.
First broker login authentication events that succeed without a corresponding user consent or confirmation event in the audit trail.
Login sessions originating from an external IdP subject that a user has explicitly disassociated within Keycloak administration.

Detection Strategies

Correlate Keycloak IDENTITY_PROVIDER_LINK_ACCOUNT and REMOVE_FEDERATED_IDENTITY events with subsequent FEDERATED_IDENTITY_LINK events for the same user and provider.
Alert on account-linking flows that complete without an intervening VERIFY_EMAIL or user confirmation step in the same session.
Baseline normal broker login patterns per realm and flag re-linking activity for previously unlinked providers.

Monitoring Recommendations

Forward Keycloak admin and login event streams to a centralized SIEM with retention sufficient to reconstruct link/unlink sequences.
Enable event listeners for jboss-logging or a custom SPI to capture federated identity lifecycle events with full context.
Review authentication logs for external IdP subjects that reappear on victim accounts after removal.

How to Mitigate CVE-2026-92358

Immediate Actions Required

Apply the Keycloak patch referenced in the Red Hat Security Advisory CVE-2026-92358 as soon as it is available for your distribution.
Audit federated identity link and unlink history for all users and force re-verification where anomalies exist.
Rotate sessions and invalidate active tokens for accounts that have unlinked an external identity provider recently.

Patch Information

Red Hat has published guidance under Red Hat Security Advisory CVE-2026-92358. Administrators should upgrade Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On to the fixed versions listed in that advisory.

Workarounds

Disable the account-linking option in first broker login flows for high-value realms until the patch is applied.
Require re-authentication with a second factor for any federated identity linking operation.
Instruct users to report unexpected external identity provider prompts and to contact administrators before re-linking removed identities.

bash

# Configuration example: harden first broker login by requiring re-authentication
# and disabling automatic linking in the Keycloak admin CLI
kcadm.sh update authentication/flows/first%20broker%20login/executions \
  -r <REALM> \
  -s 'requirement=REQUIRED' \
  -s 'authenticator=idp-review-profile'

kcadm.sh update authentication/flows/first%20broker%20login/executions \
  -r <REALM> \
  -s 'requirement=DISABLED' \
  -s 'authenticator=idp-auto-link'