Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
Keycloak CVE-2026-97175: Account Takeover Risk Unverified email auto linking in idp-auto-link lets attackers hijack accounts on Keycloak. Admins should review settings and patch quickly. For more details, read ZeroPath's blog on this vuln #AppSec #IdentitySecurity #InfoSec https://zeropath.com/blog/cve-2026-97175-keycloak-idp-auto-link-account-takeover