CVE-2026-14781: Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email
A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the emailverified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the emailverified status exclusively from the idtoken. The root cause is a lack of validation ensuring that the emailverified claim in the idtoken actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the idtoken's emailverified=true claim is blindly applied to the userinfo email. Exploitation Conditions: The OIDC identity provider must have trustEmail set to true (non-default).
The userinfo endpoint must be enabled (default).
The attacker must control or have compromised the upstream OIDC provider.
Concrete Impact: Mark arbitrary email addresses as verified in the Keycloak database.
Bypass email-based security controls or verification workflows.
Potential account takeover if the application relies solely on the emailverified flag from the IdP to link accounts.
Other sources
A flaw was found in the OIDC broker component of Keycloak, which manages authentication through external identity providers. When Keycloak is configured to trust the email addresses provided by an external provider, it incorrectly applies the "email verified" status from one part of the login process (the ID token) to an email address found in another part (the user information endpoint). This could allow a malicious or compromised identity provider to falsely mark any email address as "verified" within Keycloak, potentially leading to unauthorized account access or incorrect user data validation.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Set the upstream OIDC identity provider configuration to trustEmail=false to prevent Keycloak from trusting email addresses provided by the external provider (the issue occurs when trustEmail is true / non-default).
Keycloak OIDC broker (org.keycloak.broker.oidc) trustEmail = false - Configuration
Disable the OIDC userinfo endpoint integration (the issue requires the userinfo endpoint to be enabled by default) so Keycloak does not apply mismatched email_verified from the id_token to the userinfo email address.
Keycloak OIDC broker userinfo endpoint enabled = false - Compensating control
Ensure only trusted/controlled OIDC identity providers are used, since exploitation requires the attacker to control or have compromised the upstream OIDC provider and a mismatch between userinfo email and id_token email.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14781?
The severity of CVE-2026-14781 is medium with a score of 4.8.
How do I fix CVE-2026-14781?
To fix CVE-2026-14781, ensure that the email_verified claim is managed correctly in your OIDC configuration within Keycloak.
What vulnerability does CVE-2026-14781 address?
CVE-2026-14781 addresses an issue where the email_verified claim is incorrectly applied to the userinfo email in Keycloak's OIDC broker.
What impact does CVE-2026-14781 have on user data?
CVE-2026-14781 can lead to inaccurate email verification states for users, potentially affecting access control decisions.
Is CVE-2026-14781 exploitable remotely?
Yes, CVE-2026-14781 can be exploited remotely due to its nature in handling OIDC userinfo responses.