CVE Alert: CVE-2026-97175 – Red Hat

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim’s account by using a matching unverified email address at a brokered provider.

**Risk verdict:** Prioritise remediation promptly: this creates a credible route to account takeover, but urgency cannot be calibrated further because KEV, SSVC, PoC and EPSS data were not provided.

**Why this matters:** A successful attack could give an outsider access to a victim’s identity and the applications or data that account can reach. Likely goals include impersonation, access to business systems, data theft and abuse of the victim’s privileges.

**Most likely attack path:** An attacker needs network access to the identity service and a low-privilege account, but no victim interaction; the vulnerable federation flow can then link an attacker-controlled external identity to a matching local account. Scope is unchanged, so the flaw does not itself imply crossing into a separate security authority, though the compromised account may enable access to connected services.

**Who is most exposed:** Organisations using automatic account linking for external identity providers, especially where email verification practices vary between providers, are most exposed.

Review identity-broker events for unexpected first-time provider links to existing accounts.

Investigate account-linking events followed by new devices, locations or unusual application access.

Check for changes to recovery details, credentials, roles or linked identities after suspicious logins.

Correlate external-provider login records with local account activity and reported email-verification status.

Mitigation and prioritisation:

Apply the vendor’s corrected release as soon as available; verify affected deployments and package provenance.

Until patched, disable automatic email-based linking or require a trusted, verified identity attribute and explicit user confirmation.

Review recent links and unlink suspicious associations; reset credentials and revoke sessions for potentially compromised accounts.

Test federation changes in staging, then roll out with monitoring to avoid disrupting legitimate sign-in.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.