CVE-2026-15571: Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to exploitation?
Organizations using Keycloak's legacy client-initiated account-linking endpoint are exposed when a malicious OIDC client can induce a user to authenticate. Exploitation requires low privileges and user interaction, but can be performed remotely.
What does an attacker need to carry out the takeover?
The attacker needs to control an OIDC client and trick the target user into authenticating through it. The predictable hash can then be used to forge an account-linking URL that associates the victim account with an attacker-controlled external identity.
What is the impact if exploitation succeeds?
Successful exploitation lets the attacker log in as the victim, resulting in full account takeover with high confidentiality and integrity impact. Availability is not affected according to the provided severity vector.