Medium severity6.4NVD Advisory· Published May 20, 2026· Updated Jun 10, 2026
CVE-2026-9087
CVE-2026-9087
Description
A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.keycloak:keycloak-servicesMaven | < 26.6.3 | 26.6.3 |
Affected products
4(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:redhat:build_of_keycloak:-:*:*:*:-:*:*:*
Patches
Vulnerability mechanics
References
8- access.redhat.com/security/cve/CVE-2026-9087nvdVendor AdvisoryWEB
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingVendor AdvisoryWEB
- github.com/advisories/GHSA-m6qj-3mpp-57v8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-9087ghsaADVISORY
- access.redhat.com/errata/RHSA-2026:25097nvdWEB
- access.redhat.com/errata/RHSA-2026:25098nvdWEB
- github.com/keycloak/keycloak/commit/37dabf59d0b5ca3e5b3b272bcd3b2580e67b94ddghsaWEB
- github.com/keycloak/keycloak/releases/tag/26.6.3ghsaWEB
News mentions
0No linked articles in our index yet.