Executive brief
Keycloak, a tool used to manage user identities and logins, has a flaw in how it handles email verification when using external login providers. If a malicious or compromised login provider is used, it can trick Keycloak into marking an unverified email address as 'verified.' This could allow an attacker to bypass security checks or potentially take over user accounts that rely on email verification for access.
Technical details
A vulnerability exists in the org.keycloak.broker.oidc package of Keycloak where the OIDC broker fails to validate consistency between the email_verified claim in the id_token and the email address returned by the userinfo endpoint. When trustEmail is enabled and the userinfo endpoint is active, Keycloak applies the verification status from the id_token to the email address from the userinfo response without ensuring they refer to the same identity. An attacker controlling a compromised upstream OIDC provider can exploit this to mark arbitrary email addresses as verified in the Keycloak database. This can lead to account takeover in environments where email verification is used as a primary linking or security mechanism.
Affected products
- Red Hat Red Hat Build of Keycloak All versions using keycloak-services package
Timeline
- 2026-07-05: disclosed
- 2026-07-05: advisory