CVE-2026-15571: Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
A flaw was found in the keycloak-services component, specifically within the legacy client-initiated account-linking endpoint (/realms/{realm}/broker/{provider}/link). The endpoint validates a CSRF protection hash computed as SHA-256(nonce + userSessionId + clientId + providerAlias). The root cause is that all four inputs to this hash are accessible to a registered OIDC client: nonce is chosen by the attacker.
userSessionId is leaked as the sessionstate parameter in standard OIDC authorization responses (handled by OIDCLoginProtocol.java).
clientId and providerAlias are known to the client.
By obtaining the victim's sessionstate during a normal login flow, a malicious client can compute the required hash and generate a valid account-linking URL. If the client has the manage-account-links role (granted by default via fullScopeAllowed=true), the attacker can silently link their own upstream Identity Provider (IdP) identity to the victim's Keycloak account. Concrete Impact: Account Takeover: Attacker gains full access to the victim's account by logging in via the newly linked IdP.
Unauthorized Identity Linking: Attacker can link multiple malicious identities to a single victim account.
Data Exfiltration: Attacker can access all applications and data the victim is authorized to see.
Other sources
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
— MITRE
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Organizations using Keycloak's legacy client-initiated account-linking endpoint are exposed when a malicious OIDC client can induce a user to authenticate. Exploitation requires low privileges and user interaction, but can be performed remotely.
What does an attacker need to carry out the takeover?
The attacker needs to control an OIDC client and trick the target user into authenticating through it. The predictable hash can then be used to forge an account-linking URL that associates the victim account with an attacker-controlled external identity.
What is the impact if exploitation succeeds?
Successful exploitation lets the attacker log in as the victim, resulting in full account takeover with high confidentiality and integrity impact. Availability is not affected according to the provided severity vector.