Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the account linking process when an external identity provider (IdP) is used. The verification proof, which confirms that the user owns the email address, was not properly scoped. It was keyed only by the internal Keycloak user ID and the IdP's alias, but crucially, it was missing the user's unique ID from the external IdP. This flaw allowed an attacker to hijack the account linking process.
The patch fixes this by incorporating the external user ID into the verification process. Specifically, the IdpVerifyAccountLinkActionToken now includes the external user ID. This token is used to create a single-use object for verification, and its key is now generated by getUserVerifiedSingleObjectKey using the local user ID, the IdP alias, AND the external user ID. This ensures that the verification proof can only be consumed by the specific external identity it was created for, preventing an attacker with a different account on the same IdP from linking to the victim's Keycloak account. The functions IdpCreateUserIfUniqueAuthenticator.authenticateImpl and IdpEmailVerificationAuthenticator.sendVerifyEmail were the entry points that initiated the vulnerable workflow by either consuming the weak proof or creating the insecure token.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.keycloak:keycloak-services | maven | < 26.6.3 | 26.6.3 |
