CVE-2026-82968

6.4 Moyenne

Publiée le 02/09/2026 à 04:17 · Modifiée le 03/09/2026 à 20:12 · En attente d'analyse NVD · Source : secalert@redhat.com

Description

A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their local account, the verification proof generated is not strictly bound to the specific upstream identity being verified. This allows an attacker with a different account on the same social provider to intercept the process and link their own account to the victim's local profile, gaining unauthorized access.

Traduire en français

Produits concernés

Red Hat Build of Keycloak
Red Hat Single Sign-On 7

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.4 Moyenne	secalert@redhat.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N`

Faiblesses (CWE)

CWE-639

Références

https://access.redhat.com/security/cve/CVE-2026-82968
https://bugzilla.redhat.com/show_bug.cgi?id=2526318

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories