CVE-2026-82968 : A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.
This issue was originally tracked in the private repository. Migrated by @ahus1 .
ahus1 added priority/important Must be worked on very soon Must be worked on very soon area/identity-brokering Identity brokering — external IdPs (social, OIDC, SAML), account linking Identity brokering — external IdPs (social, OIDC, SAML), account linking kind/cve Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected Issues identified as CVEs on third-party dependencies, or issues which Keycloak is not affected team/core-iam on Sep 2, 2026
ahus1 added the cve issue type on Sep 2, 2026
stianst added this to Keycloak Roadmap on Sep 10, 2026
github-project-automation moved this to Backlog in Keycloak Roadmap on Sep 10, 2026
stianst added this to Keycloak Roadmap on Sep 10, 2026
abstractj added severity/medium 50 calendar days to fix 50 calendar days to fix on Sep 30, 2026
michalvavrik self-assigned this on Oct 1, 2026
michalvavrik added 3 commits that reference this issue on Oct 2, 2026 fix: bind first broker login verification proof to the brokered ident… 9fdd5f8 fix: bind first broker login verification proof to the brokered ident… 861178c fix: bind first broker login verification proof to the brokered ident… 4ed4bc4
fix: bind first broker login verification proof to the brokered ident…
fix: bind first broker login verification proof to the brokered ident…
fix: bind first broker login verification proof to the brokered ident…
stianst added backport/26.6 backport/26.8 on Oct 5, 2026
pedroigor closed this as completed in #53474 on Oct 5, 2026
github-actions added release/27.0.0 on Oct 5, 2026
ahus1 added a commit that references this issue on Oct 5, 2026 fix: bind first broker login verification proof to the brokered ident… This issue will close once commit aeca6e9 is merged into the 'main' branch. aeca6e9
fix: bind first broker login verification proof to the brokered ident…
vmuzikar added a commit that references this issue on Oct 7, 2026 [26.8] Bind first broker login verification proof to the brokered ide… d539eaa
[26.8] Bind first broker login verification proof to the brokered ide…
github-actions added release/26.8.1 and removed backport/26.8 on Oct 7, 2026
vmuzikar added a commit that references this issue on Oct 7, 2026 [26.6] Bind first broker login verification proof to the brokered ide… 3548645
[26.6] Bind first broker login verification proof to the brokered ide…
github-actions added release/26.6.8 and removed backport/26.6 on Oct 7, 2026
Keycloak Roadmap Status Done Show more project fields
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
