Predictable-hash account-linking forgery in Keycloak enables full account takeover
AI analysis
CVE-2026-15571 is a high-severity (CVSS 7.3) flaw in the legacy client-initiated account-linking endpoint of Keycloak, the widely used open-source identity and access management server, where the mechanism that guards the linking flow is based on a hash that a malicious OIDC client can predict (CWE-341). An attacker who controls an OIDC client registered in the victim's realm tricks the user into authenticating, then forges a valid linking URL that connects the victim's account to an external identity controlled by the attacker. The result is full account takeover: the attacker can subsequently log in as the victim, with high confidentiality and integrity impact per the CVSS vector (no availability impact, and the attack requires low privileges plus user interaction). Any Keycloak deployment using the legacy account-linking endpoint is affected, and the available data does not specify affected or fixed version ranges, so current installations should be assumed vulnerable until patched. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation is known; EPSS currently estimates only about a 0.3% probability of exploitation within 30 days.
What to do: Upgrade Keycloak to a patched release as soon as the Red Hat/Keycloak advisory publishes fixed versions (none specified in the available data), keeping in mind that only realms that use the legacy client-initiated account-linking flow and contain OIDC clients an attacker could control are meaningfully exposed. Until you can patch, restrict which clients may register in your realms, audit existing client registrations for unexpected additions, and review identity-broker account-linking events for links your users did not initiate. Recent coverage of an unauthenticated Keycloak password-reset account-takeover flaw describes a separate issue, so confirm your Keycloak patch level against both advisories.
Estimated exposure
mass≈1M+ end users across tens of thousands of deployments (widely deployed open-source IAM; no public install metric) — No public install-count metric is available, so the estimate is based on Keycloak's status as one of the most widely deployed open-source IAM servers (the upstream of Red Hat's single sign-on offering) used by thousands of organizations,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.