REDHAT-BUG-2499591: CSRF
A flaw was found in the keycloak-services component, specifically within the legacy client-initiated account-linking endpoint (/realms/{realm}/broker/{provider}/link). The endpoint validates a CSRF protection hash computed as SHA-256(nonce + userSessionId + clientId + providerAlias). The root cause is that all four inputs to this hash are accessible to a registered OIDC client: nonce is chosen by the attacker.
userSessionId is leaked as the sessionstate parameter in standard OIDC authorization responses (handled by OIDCLoginProtocol.java).
clientId and providerAlias are known to the client.
By obtaining the victim's sessionstate during a normal login flow, a malicious client can compute the required hash and generate a valid account-linking URL. If the client has the manage-account-links role (granted by default via fullScopeAllowed=true), the attacker can silently link their own upstream Identity Provider (IdP) identity to the victim's Keycloak account. Concrete Impact: Account Takeover: Attacker gains full access to the victim's account by logging in via the newly linked IdP.
Unauthorized Identity Linking: Attacker can link multiple malicious identities to a single victim account.
Data Exfiltration: Attacker can access all applications and data the victim is authorized to see.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Users who complete a normal OIDC login flow through a malicious registered OIDC client may be exposed. The client can obtain the victim's session_state from the authorization response and use it to construct a valid account-linking request.
What access does an attacker need to exploit it?
The attacker needs control of a registered OIDC client and must obtain the victim's session_state during the victim's login flow. The client also needs the manage-account-links role, which is granted by default when fullScopeAllowed=true.
What is the likely impact of successful exploitation?
An attacker can silently link an upstream IdP identity they control to the victim's Keycloak account. They can then log in through that linked identity and gain full access to the victim's account; multiple malicious identities may also be linked.