CVE-2026-15571

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the legacy client-initiated account-linking endpoint of Keycloak. The protection mechanism for the account-linking process uses a predictable hash, which a malicious OpenID Connect (OIDC) client can exploit. By inducing a user to authenticate, an attacker can forge a valid linking URL to associate the victim's account with an external identity controlled by the attacker, leading to a complete account takeover.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.