Description

A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T18:17:11.670Z",
  "pubdate": "2026-11-05T18:17:11.670Z",
  "executiveSummary": "A critical security flaw exists in the idp-auto-link authenticator within the keycloak-services component, enabling potential account takeover via identity federation.\nThe vulnerability is classified as an improper verification of email trust, where the system fails to validate the source of identity claims during the auto-linking process.\nThis flaw impacts Keycloak deployments utilizing external identity providers for user federation. An attacker can hijack a legitimate user's local account by exploiting the trust relationship between the Identity Provider (IdP) and the Keycloak Service Provider (SP).\nThe risk is severe, as it bypasses standard authentication controls by leveraging unverified email claims. Attackers do not require internal credentials; they only need an account on an integrated, malicious, or compromised identity provider that allows the registration of an email address matching a victim's account in Keycloak.\nSuccessful exploitation results in full unauthorized access to the victim's local account, leading to data exfiltration, unauthorized administrative actions, or privilege escalation depending on the victim's permissions.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic of the idp-auto-link authenticator within the keycloak-services component. When configured to automatically link brokered identities to existing local user accounts, Keycloak relies solely on the email address attribute provided by the external identity provider.\nThe system fails to enforce or verify a 'verified' claim or flag from the IdP. In standard federated identity protocols (such as OIDC), an IdP might provide an email address, but unless explicitly validated by the IdP as belonging to the user, this claim should be treated as untrusted.\nThe attack flow proceeds as follows: 1. The attacker creates an account on a legitimate or rogue identity provider that is trusted by the target Keycloak instance. 2. The attacker sets the email address of this account to match the target victim's email address registered in the Keycloak user database. 3. The attacker initiates an authentication flow through the external provider and redirects to Keycloak. 4. Upon receiving the assertion or token containing the email claim, the idp-auto-link authenticator detects a match in the Keycloak user store. 5. Because the authenticator assumes that the external provider has validated the identity claim, it automatically links the attacker-controlled external identity to the victim's existing local account without further verification.\nOnce the accounts are linked, the attacker can sign in using the external provider's credentials, which successfully logs them into the victim's local session. This effectively bypasses any existing Multi-Factor Authentication (MFA) or password policies associated with the local account, as the authentication is delegated to the external provider that the attacker controls.\nThis vulnerability is persistent; once the link is established, the attacker maintains access to the victim's account until the administrator or the user manually removes the link or disables the account. The vulnerability is exploitable over the network and does not require local system access, making it highly attractive for automated identity-based attacks."
}