CVE-2026-9087

🔶 medium

Summary

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

CVSS Score

6.4

Medium

EPSS Score

0.3

Exploit Probability

Published Date

2026-05-20

First Seen: 2026-05-21

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 40.9% of all 330,193 vulnerabilities in our database.

#195,162

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: May 21, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2026-06-26

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

CWE IDs (Weakness Types)

CWE-639

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
redhat	build_of_keycloak	Affected	v-

🔗 References 6

https://access.redhat.com/errata/RHSA-2026:25097

https://access.redhat.com/errata/RHSA-2026:25098

https://access.redhat.com/errata/RHSA-2026:30049

https://access.redhat.com/errata/RHSA-2026:30050

https://access.redhat.com/security/cve/CVE-2026-9087

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2480172

Issue Tracking Vendor Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-9791	🔶 medium	4.3	0.2	A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by acces...	2026-05-28
CVE-2026-9792	🔶 medium	6.5	0.3	A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When cer...	2026-05-28
CVE-2026-9793	🔶 medium	5.9	0.0	A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incor...	2026-05-28
CVE-2026-9794	🔶 medium	5.3	0.3	A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially cra...	2026-05-28
CVE-2026-9795	⚠️ high	7.3	0.3	A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client man...	2026-05-28
CVE-2026-9796	🔶 medium	6.5	0.0	A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check ...	2026-05-28

These CVEs affect the same products