Is CVE-2026-14781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-14781 being exploited in the wild.

How severe is CVE-2026-14781?

Medium severity, with a CVSS score of 4.8, published 5 July 2026.

Which products and versions are affected?

Red Hat build of Keycloak All versions using keycloak-services package.

Is there a fix for CVE-2026-14781?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-14781 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-14781?

Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-14781: Red Hat Keycloak improper validation of email_verified claim in OIDC broker

CVE-2026-14781 · Severity: medium · CVSS 4.8 · Published 2026-07-05

Keycloak, a tool used to manage user identities and logins, has a flaw in how it handles email verification when using external login providers. If a malicious or compromised login provider is used, it can trick Keycloak into marking an unverified email address as 'verified.' This could allow an attacker to bypass security checks or potentially take over user accounts that rely on email verification for access.

Technologies: Red Hat build of Keycloak. Vendors: Red Hat.

Quick answers

Is CVE-2026-14781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-14781 being exploited in the wild.
How severe is CVE-2026-14781?: Medium severity, with a CVSS score of 4.8, published 5 July 2026.
Which products and versions are affected?: Red Hat build of Keycloak All versions using keycloak-services package.
Is there a fix for CVE-2026-14781?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-14781 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-14781?: Check whether you run Red Hat build of Keycloak at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the org.keycloak.broker.oidc package of Keycloak where the OIDC broker fails to validate consistency between the email_verified claim in the id_token and the email address returned by the userinfo endpoint. When trustEmail is enabled and the userinfo endpoint is active, Keycloak applies the verification status from the id_token to the email address from the userinfo response without ensuring they refer to the same identity. An attacker controlling a compromised upstream OIDC provider can exploit this to mark arbitrary email addresses as verified in the Keycloak database. This can lead to account takeover in environments where email verification is used as a primary linking or security mechanism.

Affected products

Red Hat Red Hat Build of Keycloak All versions using keycloak-services package

Timeline

2026-07-05: disclosed
2026-07-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.