Account Takeover Vulnerability in Keycloak Legacy Account-Linking Endpoint

A security vulnerability (CVE-2026-15571) exists in the legacy client-initiated account-linking endpoint of Keycloak, an open-source identity and access management solution. The vulnerability stems from an insecure protection mechanism that relies on a hash which can be predicted by an attacker operating a malicious OpenID Connect (OIDC) client.

By forcing or tricking an authenticated victim into accessing a crafted link, an attacker can manipulate the account-linking process. The predictable hash allows the attacker to forge a valid linking URL that associates the victim's identity with an external identity provider controlled by the attacker. Upon successful exploitation, the attacker gains full control over the victim's account, including the ability to perform actions or log in as the victim within the targeted organization. Organizations utilizing legacy account-linking features in Keycloak should review their configuration and upgrade to versions where this endpoint is secured or disabled.

Impact

Successful exploitation leads to a complete account takeover of the targeted victim, potentially affecting any sector that relies on Keycloak for identity and access management. The impact is significant as it grants the attacker persistent access and the ability to impersonate legitimate users, which can lead to data exfiltration or lateral movement within the enterprise environment.

Recommendation

• Identify all instances of Keycloak currently in production environments.
• Review Keycloak documentation to determine if the legacy client-initiated account-linking endpoint is currently enabled.
• Disable the legacy account-linking endpoint if not strictly required for business operations.
• Apply security patches or updates provided by the Keycloak project addressing CVE-2026-15571.
• Monitor logs for unusual account-linking events or repeated authorization failures associated with OIDC client workflows.