CVE-2026-14781

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw in the org.keycloak.broker.oidc package causes the OIDC broker to incorrectly synchronize the email verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but takes the email verified status solely from the id token. Because there is no validation to ensure the email verified claim in the id token corresponds to the email address from the userinfo endpoint, a email verified=true claim from the id token can be applied to a different email address returned by the userinfo endpoint. This occurs if an attacker controls or compromises the upstream OIDC provider. This can lead to arbitrary email addresses being marked as verified in the database, bypassing email-based security controls, or potential account takeover if the application relies on the email verified flag for account linking.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, set trustEmail to false for OIDC identity providers or disable the userinfo endpoint.