CVE-2026-82968

Name of the Vulnerable Software and Affected Versions Keycloak (affected versions not specified)

Description A flaw exists in the first-broker-login flow of the Keycloak identity management service. During the process of linking a social identity provider account to a local account, the generated verification proof is not strictly bound to the specific upstream identity being verified. This allows an attacker using a different account from the same social provider to intercept the process and link their own account to a victim's local profile, resulting in unauthorized access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.